Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- index.ts:476
- Evidence
const output = execSync(cmd, {
Security audit
Stock Analysis — AIsa Edition
Security checks across malware telemetry and agentic risk
Overview
The skill's code, configuration, and runtime instructions are coherent with a stock/crypto analysis plugin that calls an external AIsa API and stores local watchlist/portfolio state; the requested API key and local storage are proportionate to its stated purpose.
This plugin is internally consistent with its stated goal: it needs an AISA_API_KEY and will send tickers and prompts to the aisa.one API to fetch live data. Before installing: (1) Decide whether you trust the external service (aisa.one) with your queries and any portfolio tickers — use a dedicated API key you can revoke. (2) Note that watchlist/portfolio data is stored locally under ~/.clawdbot/skills/stock-analysis; back it up or change CLAWDBOT_STATE_DIR if needed. (3) Review the AIsa service's privacy policy if you are concerned about data retention or telemetry. (4) If you want extra caution, run the plugin in an isolated environment and monitor outbound requests to confirm which fields are transmitted. The pre-scan alert about system-prompt override is expected for this kind of plugin (it sends system messages to the external model) and not by itself a sign of malicious behavior.
VirusTotal
No VirusTotal findings
Static analysis
Detected: suspicious.dangerous_exec, suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- index.ts:10
- Evidence
const apiKey = api.getConfig("AISA_API_KEY") || process.env.AISA_API_KEY;