ClawHub
Back to skill

Security audit

AIsa Youtube Search

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward YouTube search helper that uses an AIsa API key and sends user search queries to AIsa’s external API.

Install only if you are comfortable sending YouTube search terms and API-key-authenticated traffic to AIsa. Do not use sensitive personal data, secrets, or confidential business plans as queries unless that external sharing is acceptable for your use case.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill clearly requires an environment variable (`AISA_API_KEY`) and makes outbound network requests to `api.aisa.one`, yet the finding indicates these capabilities are not declared as permissions. This creates a transparency and policy-enforcement gap: users or hosting systems may not realize the skill can access secrets and transmit data externally, increasing the risk of unintended secret use or data exfiltration through authenticated requests.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The documentation shows search queries and authenticated requests being sent to a third-party service but does not clearly warn users that their inputs and API-key-backed traffic leave the local environment. This is dangerous because users may unknowingly submit sensitive research terms, company names, or internal topics to an external provider, creating privacy, confidentiality, and compliance risks.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.