Multi Source Search

• Outcome: Pass
• Latest audit: May 28, 2026 · 6:27 AM UTC
• Version: 1.0.1

Overview

This is a disclosed external search/research client that sends user queries, prompts, and URLs to AIsa-backed services using an AISA API key.

Install only if you are comfortable sending search terms, research prompts, optional system instructions, and supplied URLs to AIsa and its downstream providers. Avoid secrets, private/internal URLs, regulated data, or proprietary research context unless that external processing is approved.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The manifest declares required binaries and environment variables but does not explicitly declare permissions while clearly documenting network access and use of a secret API key. This can weaken least-privilege controls and informed consent because a harness or user may not realize the skill will transmit prompts, URLs, and retrieved content to an external service.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The skill is presented as a multi-source verification engine, but the documented behavior also enables standalone answer generation, deep research, crawling, extraction, and site mapping. This broader capability surface increases the chance that users or orchestrators invoke higher-risk actions than expected, causing unintended data disclosure or broader external interaction.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The manifest frames the skill as verification-oriented retrieval, but the documented APIs include extraction, crawl, and mapping features that can pull and traverse arbitrary external content. That mismatch matters because operators may approve a low-risk search tool while actually enabling a broader web interaction capability.

Description-Behavior Mismatch

Medium

• Confidence: 81% confidence
• Finding: The documentation positions the skill as a validation lane, yet examples encourage standalone deep research report generation through external LLM-backed endpoints. This can mislead users about where their prompts are sent and about the skill's actual function, expanding privacy and governance risk.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill manifest describes multi-source search and retrieval, but the code also exposes crawling and site-mapping operations. That scope expansion can collect substantially more third-party content than users may expect, increasing data exfiltration, scraping, and misuse risk beyond a search-only tool.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The Perplexity-backed methods accept arbitrary system instructions and forward them directly to the remote model endpoint. In a search-focused skill, this permits repurposing the tool into a more general remote LLM interface, which can bypass intended capability boundaries and weaken prompt-safety assumptions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation repeatedly shows sending user queries, messages, and arbitrary URLs to external APIs, but it does not provide a clear warning about third-party disclosure, retention, or handling of sensitive data. In practice, users may paste confidential research topics, internal URLs, or proprietary text into requests believing this is only local tooling.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: These call sites transmit user-supplied queries and possibly sensitive research prompts to external APIs without any disclosure, consent, or minimization controls in the tool itself. In agent settings, users may not realize their input is leaving the local environment and being processed by third parties.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Sonar

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 84% confidence
• Finding: The Sonar example forwards user prompts to a third-party endpoint that may process and retain content outside the local environment. In a skill marketed for research and verification, users may supply sensitive material, making undisclosed transmission materially risky.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Sonar

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 84% confidence
• Finding: The Sonar example forwards user prompts to a third-party endpoint that may process and retain content outside the local environment. In a skill marketed for research and verification, users may supply sensitive material, making undisclosed transmission materially risky.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Sonar Pro

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar-pro" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 85% confidence
• Finding: The Sonar Pro endpoint sends richer analytical prompts externally, which can include proprietary research questions or internal context. Because the skill does not clearly warn about this disclosure, the example creates a realistic confidentiality risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Sonar Reasoning Pro

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar-reasoning-pro" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 85% confidence
• Finding: The reasoning-focused endpoint encourages users to submit nuanced analytical content that may reveal sensitive strategy, market views, or internal plans. Externalizing such prompts without an explicit warning increases data leakage risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Sonar Deep Research

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar-deep-research" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 87% confidence
• Finding: Deep-research workflows often involve large, detailed prompts and synthesized context, which increases the volume and sensitivity of data sent off-platform. Without a clear disclosure, users may unknowingly transmit confidential research materials to external providers.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Content-Type: application/json" \
  -d '{"query":"latest AI developments"}'

curl -X POST "https://api.aisa.one/apis/v1/tavily/extract" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"urls":["https://example.com/article"]}'

• Confidence: 91% confidence
• Finding: The extract endpoint accepts arbitrary URLs and causes remote retrieval and content extraction through a third-party service. This is riskier than ordinary search because users may submit private, internal, signed, or sensitive URLs, leading to unintended disclosure of URL targets and fetched content.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Content-Type: application/json" \
  -d '{"urls":["https://example.com/article"]}'

curl -X POST "https://api.aisa.one/apis/v1/tavily/crawl" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com","max_depth":2}'

• Confidence: 92% confidence
• Finding: The crawl endpoint can recursively traverse a supplied URL, amplifying data collection and disclosure beyond a single page. In the absence of guardrails, this can cause broad external fetching of sensitive sites, internal documentation portals, or authenticated resources if users provide such targets.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Content-Type: application/json" \
  -d '{"url":"https://example.com","max_depth":2}'

curl -X POST "https://api.aisa.one/apis/v1/tavily/map" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

• Confidence: 89% confidence
• Finding: The map endpoint can enumerate site structure for an arbitrary URL via an external service, which broadens reconnaissance capability and may expose information about non-public or sensitive web properties. In a skill framed as search verification, this functionality is more dangerous because operators may not expect site-enumeration behavior.

Static analysis

No suspicious patterns detected.