Security audit
Aisa Youtube Search Plugin
Security checks across malware telemetry and agentic risk
Overview
The package is internally consistent for a YouTube search plugin that calls the AIsa service and only requires an AISA_API_KEY; nothing in the files suggests unexpected or unrelated privileges.
This package appears to be what it claims: a wrapper that invokes the bundled AIsa YouTube search skill and requires an AISA_API_KEY. Before installing, verify that you intend to provide an AISA_API_KEY (the plugin manifest requires it) and that the key you supply is scoped appropriately (avoid reusing high-privilege or long-lived secrets). Review the embedded SKILL.md and any scripts in the skills/ folder if you want to confirm exact network targets or CLI commands. The only real inconsistency is a metadata omission that lists "no required env vars" in the registry summary—treat that as a documentation error and rely on the manifest/SKILL.md which do require AISA_API_KEY. If you do not trust the AIsa service or the key, do not install or provide credentials.
VirusTotal
No VirusTotal findings
Static analysis
No suspicious patterns detected.
