Back to plugin

Security audit

Aisa Youtube Search Plugin

Security checks across malware telemetry and agentic risk

Overview

The package is internally consistent for a YouTube search plugin that calls the AIsa service and only requires an AISA_API_KEY; nothing in the files suggests unexpected or unrelated privileges.

This package appears to be what it claims: a wrapper that invokes the bundled AIsa YouTube search skill and requires an AISA_API_KEY. Before installing, verify that you intend to provide an AISA_API_KEY (the plugin manifest requires it) and that the key you supply is scoped appropriately (avoid reusing high-privilege or long-lived secrets). Review the embedded SKILL.md and any scripts in the skills/ folder if you want to confirm exact network targets or CLI commands. The only real inconsistency is a metadata omission that lists "no required env vars" in the registry summary—treat that as a documentation error and rely on the manifest/SKILL.md which do require AISA_API_KEY. If you do not trust the AIsa service or the key, do not install or provide credentials.

VirusTotal

No VirusTotal findings

View on VirusTotal

Static analysis

No suspicious patterns detected.