The Agent Skills Directory

[DATA_EXPOSURE]: The script scripts/search_client.py implements a credential resolution mechanism in the _resolve_aisa_api_key function. It attempts to read the AISA_API_KEY from ~/.aisa/credentials and .env files located within the .hermes directory. This behavior is documented as a way to support specific agent harness environments where environment variables might be restricted. The extracted key is used solely for authentication with the official vendor API.
[EXTERNAL_DOWNLOADS]: The skill performs legitimate network operations to https://api.aisa.one using Python's urllib library. These operations are essential for the skill's stated purpose of providing web, scholar, and reasoning search results. The targets are limited to the vendor's official API endpoints.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a proxy for search queries and system instructions provided by the user (via --query and --system flags). While this introduces an ingestion surface for untrusted data, the skill does not possess high-risk local capabilities (such as file writing or command execution) that could be exploited by malicious search results. Data is properly serialized using JSON before being sent to the remote API.

multi-source-search