AIsa Financial Data

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a straightforward financial market-data client, but it uses an AIsa API key and sends requested ticker/query data to AIsa.

This skill looks coherent for financial-data lookup. Before installing, make sure you trust AIsa with your API key and the ticker, portfolio, or screening queries you ask it to process, and consider using a dedicated API key with usage monitoring.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Info

#ASI02: Tool Misuse and Exploitation

What this means

Using the skill can cause the agent or user to make authenticated API requests to AIsa for market data.

Why it was flagged

The skill provides direct curl examples for authenticated market-data API calls. This is expected for the skill's purpose and is presented as user-directed documentation.

Skill content

curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL..." -H "Authorization: Bearer $AISA_API_KEY"

Recommendation

Review requested queries before running them, especially if the API key has usage limits or billing attached.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill can use your AIsa API credential to access the provider's financial-data service, which may affect account quotas, billing, or audit logs.

Why it was flagged

The client reads the AISA_API_KEY environment variable and uses it as a bearer token for API requests.

Skill content

self.api_key = api_key or os.environ.get("AISA_API_KEY") ... "Authorization": f"Bearer {self.api_key}"

Recommendation

Use a dedicated or limited-scope API key if available, keep it out of chat content and logs, and monitor usage.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

AIsa may receive information about the companies, crypto assets, filters, or portfolio symbols you ask the skill to analyze.

Why it was flagged

Market queries are sent to the external AIsa API endpoint, including user-selected tickers, date ranges, screening filters, or portfolio symbols.

Skill content

BASE_URL = "https://api.aisa.one/apis/v1"

Recommendation

Avoid sending confidential portfolio details or sensitive research queries unless you are comfortable sharing them with the AIsa service.