Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed YouTube search client that sends user search terms to AIsa's API using an AISA_API_KEY, with no hidden persistence or local account access found.
Before installing, confirm you trust AIsa with YouTube search queries, filter tokens, and authenticated API usage tied to AISA_API_KEY. Avoid using it for sensitive private research terms if those should not be sent to api.aisa.one.
The skill declares that it requires environment access and makes network requests, but it does not explicitly constrain tool scope with permissions or allowed-tools. In an agent ecosystem, that omission can allow broader-than-necessary execution or make sensitive capabilities less visible to reviewers, increasing the chance of unintended secret exposure or outbound requests.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class YouTubeClient:
"""AIsa YouTube - YouTube SERP Scout API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class YouTubeClient:
"""AIsa YouTube - YouTube SERP Scout API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class YouTubeClient:
"""AIsa YouTube - YouTube SERP Scout API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
This code file performs outbound network requests to a remote API using both the user's search terms and a bearer token from the environment, but the runtime path provides no confirmation prompt or user-visible notice that data will be sent off-system. While network access is central to the client’s purpose, the code lacks any explicit disclosure in the CLI output or comments for this transmission behavior and credential use.
No suspicious patterns detected.