Security audit
Security checks for vulnerabilities and agentic risk
This is a web search helper that calls AISA's API; it has broader research modes than the short description says, but I found no hidden local access, persistence, or destructive behavior.
Install only if you are comfortable sending search terms, requested URLs, and related results to AISA's API using your AISA_API_KEY. Avoid using it with secrets, private URLs, regulated data, or credential-related requests. The packaged client includes research and extraction modes beyond simple title/link/snippet search, so review those modes before letting an agent invoke them automatically.
The declared behavior says this is a lightweight web-search skill, but the detected capabilities include broader research, synthesis, arbitrary URL extraction, and multi-source aggregation. This mismatch is dangerous because users or orchestrators may invoke the skill under the assumption of simple search while it can send data to additional endpoints or process arbitrary URLs in ways not transparently disclosed.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## When NOT to Use
- Do not use this skill for browser-cookie extraction, passwords, Keychain access, or other local sensitive credential access.
- Prefer a different skill when the user request is outside this skill's domain.
## Capabilities
The skill declares environment and network capabilities but does not explicitly scope or constrain permitted tools/actions. That omission weakens least-privilege controls and makes it harder for operators and users to understand what the skill may access, increasing the chance of unintended network use or misuse of the API key.
The invocation language is broad enough to match many normal user requests, which can cause over-selection of this skill by an agent router. Overbroad matching becomes a security concern when the skill performs external network actions, because benign user text may be unnecessarily transmitted to third-party services.
The skill does not prominently disclose that user queries are sent to an external search endpoint. This creates a data-handling and privacy risk because users may provide sensitive information under the assumption that processing is local or internal.
The skill transmits user queries and, in some modes, extracted third-party content to an external service at api.aisa.one. External transmission is expected for web search, but the undeclared breadth of transmitted data—especially extracted page content and synthesized multi-source results—makes this more sensitive than a simple search-only skill.
from concurrent.futures import ThreadPoolExecutor, as_completed
from typing import Any
AISA_BASE = "https://api.aisa.one/apis/v1"
def get_api_key() -> str:
The skill metadata says it is for structured public web search results, but this code also performs URL content extraction and AI-generated synthesis. That scope expansion increases data exposure and capability risk because arbitrary URLs can be fetched and their contents relayed to a remote synthesis endpoint without being clearly declared in the skill contract.
The verity command hard-codes the explanation request language to "en", which imposes a specific language regardless of user preference. This is a natural-language policy issue because the file does not offer a language choice or document a justified region-specific constraint.
The manifest sets "language": "en", which is a natural-language locale restriction. There is no indication in this file that users can opt into another language or that the English-only setting is required for a documented regional or compliance reason.
The top-level docstring presents the program as a multi-source search client. In practice, the implementation includes non-search operations such as extracting raw content from provided URLs and generating synthesized explanations from aggregated results, which contradicts the narrower framing in the documentation.
The skill manifest frames the skill as a web search interface and does not mention credential handling. Accessing AISA_API_KEY from the environment is an additional capability involving secret access; while operationally common for API clients, it is not justified by the manifest text alone under this auditing rubric.
No suspicious patterns detected.