Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Perplexity/AIsa search wrapper, with expected third-party API use and no hidden persistence or unrelated local access found.
Install only if you intend to send search prompts, queries, and any optional system instructions to AIsa's Perplexity API using your AISA_API_KEY. Avoid sending secrets, private customer data, or confidential material unless you are comfortable with that third-party handling.
The skill requires environment access to read AISA_API_KEY and performs network requests to an external API, but it does not declare an explicit tool scope such as permissions or allowed-tools. In agent harnesses that rely on manifest scoping for isolation or user consent, this can lead to over-broad execution and reduce visibility into sensitive capabilities.
The skill description explains functionality but does not clearly warn that user prompts, queries, and optional system messages are transmitted to a third-party service. This creates a data-handling transparency issue and can cause users or calling agents to send sensitive information externally without informed consent.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
--system "Respond in markdown with an executive summary first."
## Curl Examples
### Sonar
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class PerplexitySearchClient:
"""Minimal client for AIsa Perplexity Sonar endpoints."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
self.api_key = api_key or os.environ.get("AISA_API_KEY")
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class PerplexitySearchClient:
"""Minimal client for AIsa Perplexity Sonar endpoints."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
self.api_key = api_key or os.environ.get("AISA_API_KEY")
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class PerplexitySearchClient:
"""Minimal client for AIsa Perplexity Sonar endpoints."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
self.api_key = api_key or os.environ.get("AISA_API_KEY")
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class PerplexitySearchClient:
"""Minimal client for AIsa Perplexity Sonar endpoints."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
self.api_key = api_key or os.environ.get("AISA_API_KEY")
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class PerplexitySearchClient:
"""Minimal client for AIsa Perplexity Sonar endpoints."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
self.api_key = api_key or os.environ.get("AISA_API_KEY")
This code packages the user-provided query and optional system instruction into a JSON request body and sends it to a remote API endpoint. Although network access is the script's purpose, there is no visible user-facing disclosure in the CLI help or runtime output that these inputs will be transmitted to an external service.
No suspicious patterns detected.