YouTube SERP Scout

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a straightforward YouTube search helper that uses an AIsa API key and sends search queries to AIsa, with no hidden or destructive behavior evident in the provided artifacts.

Before installing, confirm you trust the AIsa API provider with your YouTube research queries and use a dedicated API key where possible. The provided artifacts do not show hidden installs, persistence, local data access, or destructive behavior.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Using the skill lets the agent make requests against the user's AIsa account, which may affect account usage, quotas, or billing.

Why it was flagged

The skill requires an AIsa API key as its primary credential. This is purpose-aligned for an authenticated API client and the artifacts do not show hardcoding, logging, or unrelated use of the key.

Skill content

requires":{"bins":["curl","python3"],"env":["AISA_API_KEY"]},"primaryEnv":"AISA_API_KEY"

Recommendation

Use a dedicated or least-privileged AIsa API key if available, avoid exposing the key in prompts or logs, and rotate it if it is accidentally shared.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Search terms, competitor names, and related research queries may be visible to the API provider as part of normal operation.

Why it was flagged

The client sends authenticated requests, including user-provided search queries, to the external AIsa API endpoint. This is disclosed and central to the skill's purpose.

Skill content

BASE_URL = "https://api.aisa.one/apis/v1" ... "Authorization": f"Bearer {self.api_key}"

Recommendation

Avoid sending confidential strategy terms or sensitive internal names unless you are comfortable sharing them with the AIsa API provider.