Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent search plugin that sends user-directed queries and URLs to the disclosed AIsa-backed search APIs.
Install only if you are comfortable sending search terms, URLs, and extracted content requests to AIsa and its integrated search providers. Do not use it with secrets, private internal URLs, regulated data, or confidential research topics unless your organization permits that data flow.
The skill declares access to environment variables and depends on networked API calls, but it does not define any explicit tool scope such as permissions or allowed-tools. That makes the runtime trust boundary unclear and can allow broader-than-necessary execution or invocation behavior in hosts that rely on declarative scoping for policy enforcement.
The skill encourages users to submit search queries and URLs to its tools, but it does not clearly warn that these inputs are sent to external AIsa services and potentially onward to third-party providers like Tavily or Perplexity. Users may inadvertently disclose sensitive prompts, internal URLs, or proprietary research topics to external processors without informed consent.
The skill is explicitly designed to transmit user-supplied queries and URLs to an external API endpoint at api.aisa.one. While external transmission is expected for a search skill, it still creates a real data-exposure risk if users provide confidential input, especially given the multi-provider backend described elsewhere in the file.
## API Endpoints Reference
All endpoints use the AIsa API base URL `https://api.aisa.one/apis/v1`.
| Endpoint | Method | Description |
|----------|--------|-------------|
The plugin transmits user-provided queries, URLs, and potentially extracted page content to a third-party service (AIsa and downstream providers like Tavily/Perplexity) without any visible consent, warning, or data-minimization control in the skill code. This creates a real privacy and compliance risk because users may unknowingly send sensitive prompts, internal URLs, or proprietary content off-platform.
The call to the explanation endpoint explicitly sets language: "en", which forces a specific language regardless of user preference. This is a natural-language policy issue because the file does not offer opt-in language selection or explain why English-only output is required.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from concurrent.futures import ThreadPoolExecutor, as_completed
from typing import Any
AISA_BASE = "https://api.aisa.one/apis/v1"
def get_api_key() -> str:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from concurrent.futures import ThreadPoolExecutor, as_completed
from typing import Any
AISA_BASE = "https://api.aisa.one/apis/v1"
def get_api_key() -> str:
This code sends user-provided search queries to a remote service via HTTP POST, which is a privacy-relevant network operation. While the script identifies itself as a search client, it does not visibly disclose at the point of execution that query text will be sent to third-party API endpoints, and the same pattern recurs across commands.
The explain request forces "language": "en", which imposes a specific language/locale choice on output. There is no user opt-in or configurable language parameter, so this is a natural-language policy violation under the locale-choice rule.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
}
},
"dependencies": {
"@sinclair/typebox": "^0.32.0"
}
}
The code reads an API credential from the environment, which falls under sensitive credential access. Although the module docstring says the variable is required, it does not warn users about handling or security expectations for the credential beyond its existence.
No suspicious patterns detected.