AIsa Multi Source Search

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 3:36 AM UTC
• Version: 1.0.0

Overview

This is a disclosed external search client that sends user queries and URLs to AIsa, with no evidence of hidden persistence, credential theft, or destructive behavior.

Install only if you are comfortable sending search terms, target URLs, retrieved content, and result bundles to AIsa's API. Use a scoped API key, avoid secrets and private/internal URLs, and get authorization before using crawl or map features on third-party sites.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly requires environment access for an API key and performs outbound network operations, yet it does not declare corresponding permissions. This creates a transparency and governance gap: hosts or users may not realize the skill can exfiltrate prompts, queries, URLs, or metadata to a remote service.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The top-level description frames the skill as search, but the documented behavior includes broader remote-content operations such as full-page retrieval, URL extraction, crawling, sitemap generation, and explain/meta-analysis. That mismatch can cause users or orchestrators to approve the skill for simple search while unintentionally enabling collection and transmission of larger amounts of external or user-supplied content.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The examples show user queries and potentially sensitive URLs being sent to external APIs without any explicit privacy warning or consent language. In an agent context, this is risky because users may assume a local search utility while the skill actually transmits input and targets to a third-party service.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The quick-start instructs users to set an API key and use remote endpoints but does not warn about third-party processing or safe credential handling. This omission increases the chance of accidental misuse, such as exposing keys in shared shells, logs, or sending sensitive data to the service without understanding the trust boundary.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"query":"latest AI developments"}'

# Extract content from URLs
curl -X POST "https://api.aisa.one/apis/v1/tavily/extract" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"urls":["https://example.com/article"]}'

• Confidence: 86% confidence
• Finding: https://api.aisa.one/

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"urls":["https://example.com/article"]}'

# Crawl web pages
curl -X POST "https://api.aisa.one/apis/v1/tavily/crawl" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com","max_depth":2}'

• Confidence: 90% confidence
• Finding: https://api.aisa.one/

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"url":"https://example.com","max_depth":2}'

# Site map
curl -X POST "https://api.aisa.one/apis/v1/tavily/map" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

• Confidence: 84% confidence
• Finding: https://api.aisa.one/

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.