Security audit
Security checks for vulnerabilities and agentic risk
This is a functional AISA search skill, but it bundles under-documented modes that can send user queries and URLs to external services.
Install only if you are comfortable sending search prompts, selected URLs, and generated result bundles to AISA-hosted endpoints. Avoid using the extract or sonar modes with private, signed, internal, or sensitive URLs unless you have reviewed the provider's data handling terms.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## When NOT to Use
- Do not use this skill for browser-cookie extraction, passwords, Keychain access, or other local sensitive credential access.
- Prefer a different skill when the user request is outside this skill's domain.
## Capabilities
The skill declares access to an environment variable and relies on a networked Python client, but it does not define any explicit tool scope such as permissions or allowed-tools. That creates an overbroad execution model where the runtime may have more capability than the skill contract communicates, increasing the risk of unintended network use or secret exposure if the backing script changes or is misused.
The script exposes capabilities beyond the declared 'smart-search' purpose, including arbitrary URL extraction and separate LLM/deep-research modes. This scope expansion is dangerous because users, reviewers, or policy gates may authorize the skill for limited search use while it can also transmit arbitrary URLs and route prompts to broader external services, increasing data-handling and misuse risk.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from concurrent.futures import ThreadPoolExecutor, as_completed
from typing import Any
AISA_BASE = "https://api.aisa.one/apis/v1"
def get_api_key() -> str:
The extract command accepts user-supplied URLs and sends them to a remote extraction service, which is broader than simple web+academic search. This creates a privacy and data-exfiltration risk because users may submit internal, signed, sensitive, or otherwise non-public URLs to a third party without the skill's stated purpose making that behavior expected.
The extraction flow transmits user-provided URLs to an external service and retrieves remote page content without an explicit privacy warning or consent step. This is dangerous because the URL itself may embed secrets or point to sensitive resources, and the returned content may contain confidential data that gets processed by a third party.
The sonar command provides a general chat/deep-research interface that exceeds the declared smart-search scope. That mismatch is risky because it enables broader prompt transmission and potentially different downstream model behavior than users or reviewers would expect from a search-only skill.
The code explicitly sets "language": "en" for the explain/synthesis step, which forces English output regardless of user preference. This is a natural-language locale policy concern because there is no opt-in, configuration option, or documented justification for restricting output to English.
The manifest sets "language": "en", which imposes a specific language setting in natural-language metadata. There is no indication in this file that the language choice is optional, user-configurable, or justified by a region-specific purpose.
The docstring and CLI help describe the command as search plus confidence scoring, but later code sends collected results to '/scholar/explain' to generate a synthesized summary and citations. That documentation understates and therefore contradicts the actual behavior by omitting an additional AI summarization phase.
No suspicious patterns detected.