Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward AIsa/Tavily web research wrapper that sends user-provided searches or URLs to AIsa with an API key, with no evidence of hidden persistence, privilege escalation, or unrelated behavior.
Install only if you are comfortable sending search queries or supplied URLs to AIsa/Tavily using your AISA_API_KEY. Avoid using it with secrets, private internal documents, regulated personal data, or queries that should stay local.
The skill declares access to an API key and implies networked execution, but it does not define an explicit tool scope such as allowed tools or permissions boundaries. In an agent ecosystem, that increases the chance the skill is invoked with broader authority than intended, enabling unbounded outbound requests or unintended secret exposure paths through environment-backed execution.
The description uses broad triggers like 'user needs search, synthesis, competitor scans, or trend discovery,' which are common requests and lack precise invocation boundaries. That can cause over-invocation of a network-capable skill, sending user queries or sensitive context to external services when a local answer or narrower tool would have been sufficient.
The example requests are broad and everyday in nature, encouraging use for generic research and comparisons without clarifying privacy, sensitivity, or consent boundaries. In a skill that performs external retrieval, ambiguous examples can normalize routing arbitrary prompts to third-party services, increasing data leakage and unnecessary external dependency risk.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
process.exit(1);
}
const resp = await fetch("https://api.aisa.one/apis/v1/tavily/extract", {
method: "POST",
headers: {
"Content-Type": "application/json",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
process.exit(1);
}
const resp = await fetch("https://api.aisa.one/apis/v1/tavily/extract", {
method: "POST",
headers: {
"Content-Type": "application/json",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
process.exit(1);
}
const resp = await fetch("https://api.aisa.one/apis/v1/tavily/extract", {
method: "POST",
headers: {
"Content-Type": "application/json",
This code sends user-supplied URLs to an external API and includes a bearer token from an environment variable, but there is no confirmation prompt, user-facing notice, or explanatory comment/docstring disclosing that data is transmitted off-host. For a code file, this matches the missing-warning criterion for network/HTTP calls and sensitive credential use when no visible disclosure is present.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
body.days = days;
}
const resp = await fetch("https://api.aisa.one/apis/v1/tavily/search", {
method: "POST",
headers: {
"Content-Type": "application/json",
This code sends the user-provided query to a third-party HTTPS endpoint, which is a data-transmitting network operation covered by the missing-warning rule for code files. While the usage string documents arguments, it does not disclose that query contents will be sent off-box to an external service.
No suspicious patterns detected.