Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward AIsa-backed web research helper that sends search queries or supplied URLs to AIsa, which fits its stated purpose.
Install only if you are comfortable using AIsa as a third-party research provider. Do not pass private document links, localhost/internal URLs, secret-bearing query strings, or sensitive searches unless you intend to share them with AIsa.
The skill declares required environment variables and implicitly supports networked research, but it does not define an explicit tool scope such as allowed-tools or permissions. In an agent ecosystem, this can cause overbroad execution authority or ambiguous policy enforcement, increasing the chance that the skill is invoked with more capabilities than intended.
The description uses broad activation terms like search, synthesis, competitor scans, and trend discovery, which can match many common user requests. This raises the risk of over-triggering the skill in contexts where web access, external data retrieval, or use of the API key is unnecessary, expanding attack surface and risking unintended data exposure.
The 'When to use' section lists broad positive triggers but does not define boundaries or exclusion conditions. In agent routing systems, this ambiguity can cause the skill to be selected for generic research tasks, leading to unnecessary external calls, excess privilege use, and less predictable behavior.
This code performs an outbound HTTPS request to an external API and includes user-provided URLs in the request body. While external transmission is expected for this skill's functionality, it is still security-relevant because it can leak sensitive targets or metadata to a third party if users are not clearly informed or if untrusted inputs are passed through unchecked.
process.exit(1);
}
const resp = await fetch("https://api.aisa.one/apis/v1/tavily/extract", {
method: "POST",
headers: {
"Content-Type": "application/json",
This code performs an outbound HTTPS request to an external API and includes user-provided URLs in the request body. While external transmission is expected for this skill's functionality, it is still security-relevant because it can leak sensitive targets or metadata to a third party if users are not clearly informed or if untrusted inputs are passed through unchecked.
process.exit(1);
}
const resp = await fetch("https://api.aisa.one/apis/v1/tavily/extract", {
method: "POST",
headers: {
"Content-Type": "application/json",
The script transmits user-supplied URLs to a third-party service without any explicit disclosure, confirmation, or guardrail beyond basic CLI usage. In a research/extraction skill, URLs may contain sensitive internal endpoints, private document links, or query-bearing URLs, so silent forwarding to an external API creates a real data exposure and privacy risk.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
body.days = days;
}
const resp = await fetch("https://api.aisa.one/apis/v1/tavily/search", {
method: "POST",
headers: {
"Content-Type": "application/json",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
body.days = days;
}
const resp = await fetch("https://api.aisa.one/apis/v1/tavily/search", {
method: "POST",
headers: {
"Content-Type": "application/json",
No suspicious patterns detected.