Multi-source retrieval with confidence scoring - web, academic, and Tavily in one unified API

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a coherent search API skill; the main things to notice are that it uses an AIsa API key and sends search queries or URLs to an external service.

This skill looks purpose-aligned and not suspicious based on the provided artifacts. Before installing, make sure you are comfortable giving it an AIsa API key and sending your search queries or URLs to api.aisa.one; avoid using it with confidential data unless that provider is approved for such use.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing or using the skill requires a service credential that may allow API usage under the user's AIsa account.

Why it was flagged

The helper script reads the AIsa API key from the environment and sends it as a bearer token to the API.

Skill content
self.api_key = api_key or os.environ.get("AISA_API_KEY") ... "Authorization": f"Bearer {self.api_key}"
Recommendation

Use a dedicated, revocable API key with the least access available, and avoid sharing the key in prompts, logs, or examples.

What this means

Sensitive search terms, research topics, or private URLs entered into the skill could be transmitted to the external service.

Why it was flagged

Search queries and URL lists are sent to an external API provider for web, academic, Tavily, and extraction operations.

Skill content
BASE_URL = "https://api.aisa.one/apis/v1" ... def tavily_extract(self, urls: List[str]) ... data={"urls": urls}
Recommendation

Do not submit confidential queries or private URLs unless the provider's privacy and data-handling terms are acceptable for that data.

What this means

Using the helper runs local Python code that makes network requests to the AIsa API.

Why it was flagged

The skill includes a local Python command-line helper, but its use is explicitly shown as a user-directed command and no automatic execution is indicated.

Skill content
python scripts/search_client.py web --query "AI frameworks" ... python scripts/search_client.py verity --query "Is quantum computing enterprise-ready?"
Recommendation

Run the helper only from the reviewed skill directory and with an API key intended for this service.

What this means

An agent or user might rely too heavily on a numeric confidence score for factual or high-stakes decisions.

Why it was flagged

The skill emphasizes confidence scoring, which is useful for research but could be over-trusted if treated as proof of correctness.

Skill content
The Verity-style search returns a deterministic confidence score (0-100)
Recommendation

Treat confidence scores as advisory and independently verify important claims, especially for legal, medical, financial, or operational decisions.