YouTube SERP Scout

• Outcome: Pass
• Latest audit: May 28, 2026, 10:48 AM
• Version:
  1.0.1

Overview

This is a straightforward YouTube research helper that sends user search terms to AIsa using the user's API key.

Install only if you are comfortable sending YouTube research queries, competitor names, locale parameters, and related request metadata to AIsa under your AISA_API_KEY. Use a dedicated API key when possible, and avoid submitting confidential strategy terms, secrets, or personal data unless AIsa is approved for that data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to send search queries to api.aisa.one using a bearer token but does not clearly disclose that user-provided prompts, search terms, and related metadata will be transmitted to a third-party service. In an agent setting, users may assume searches are local or first-party, causing unintentional sharing of potentially sensitive research terms or business intelligence.

VirusTotal

65/65 vendors flagged this skill as clean.