Save upto 50% for model tokens: OpenAI GPT, Claude, Gemini, Qwen, Deepseek, Grok and more with one single key

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:40 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward LLM API router that sends user-selected prompts and images to the disclosed AISA endpoint, with no hidden persistence or local data access beyond its API key.

Install only if you are comfortable sending prompts, conversation history, image URLs or image data, and tool/function schemas to AISA's external API for model routing. Do not send secrets, regulated data, private screenshots, or internal documents unless that external processing is approved, and keep the AISA_API_KEY out of code, logs, and shared shell history.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (21)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/llm_router_client.py (reported line 255)May include surrounding context.

python

formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog="""
Examples:
    %(prog)s chat --model gpt-4.1 --message "Hello!"
    %(prog)s chat --model claude-3-sonnet --message "Write a poem" --stream
    %(prog)s chat --model gpt-4 --system "You are a pirate" --message "Greet me"
    %(prog)s vision --model gpt-4o --image "https://example.com/img.jpg" --prompt "Describe this"

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/llm_router_client.py (reported line 256)May include surrounding context.

python

epilog="""
Examples:
    %(prog)s chat --model gpt-4.1 --message "Hello!"
    %(prog)s chat --model claude-3-sonnet --message "Write a poem" --stream
    %(prog)s chat --model gpt-4 --system "You are a pirate" --message "Greet me"
    %(prog)s vision --model gpt-4o --image "https://example.com/img.jpg" --prompt "Describe this"
    %(prog)s compare --models "gpt-4.1,claude-3-sonnet" --message "Explain AI"

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/llm_router_client.py (reported line 257)May include surrounding context.

python

Examples:
    %(prog)s chat --model gpt-4.1 --message "Hello!"
    %(prog)s chat --model claude-3-sonnet --message "Write a poem" --stream
    %(prog)s chat --model gpt-4 --system "You are a pirate" --message "Greet me"
    %(prog)s vision --model gpt-4o --image "https://example.com/img.jpg" --prompt "Describe this"
    %(prog)s compare --models "gpt-4.1,claude-3-sonnet" --message "Explain AI"
    %(prog)s models

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/llm_router_client.py (reported line 258)May include surrounding context.

python

%(prog)s chat --model gpt-4.1 --message "Hello!"
    %(prog)s chat --model claude-3-sonnet --message "Write a poem" --stream
    %(prog)s chat --model gpt-4 --system "You are a pirate" --message "Greet me"
    %(prog)s vision --model gpt-4o --image "https://example.com/img.jpg" --prompt "Describe this"
    %(prog)s compare --models "gpt-4.1,claude-3-sonnet" --message "Explain AI"
    %(prog)s models
        """

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly instructs users to send chat prompts and image URLs to a third-party endpoint but does not warn that user inputs and referenced image content leave the local environment and are transmitted to an external service. In an agent context, this omission can lead operators to unknowingly route sensitive prompts, secrets, internal documents, or private image references to an external provider, creating confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The documented SDK configuration hard-codes a third-party base URL, meaning all model requests are routed off-platform to api.aisa.one rather than directly to the model vendor or a local service. This is not inherently malicious, but in a security-sensitive agent skill it is dangerous when paired with insufficient disclosure because it normalizes external transmission of potentially sensitive prompts and responses.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

md

client = OpenAI(
    api_key=os.environ["AISA_API_KEY"],
    base_url="https://api.aisa.one/v1"
)

response = client.chat.completions.create(

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares environment and network capabilities via required binaries and an API key, but does not declare an explicit tool scope such as permissions or allowed-tools. That makes the skill's effective authority less transparent to users and host systems, increasing the chance that prompts, images, or credentials are used in ways the user did not clearly authorize.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This example explicitly sends conversation contents plus the bearer API key to an external service. The transmission itself is expected for an LLM gateway, but it is still security-relevant because users may unknowingly submit sensitive data through a third-party router that may further relay it to multiple downstream model vendors.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

Request

bash

curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This example explicitly sends conversation contents plus the bearer API key to an external service. The transmission itself is expected for an LLM gateway, but it is still security-relevant because users may unknowingly submit sensitive data through a third-party router that may further relay it to multiple downstream model vendors.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

Request

bash

curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs users to send chat prompts to a third-party endpoint and elsewhere also supports image analysis, but it does not prominently warn that submitted text and images leave the local environment. In an agent setting, this can lead to unintentional disclosure of sensitive prompts, files, screenshots, or business data to an external provider.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The streaming example also transmits user prompts and credentials to the remote API. Streaming can increase exposure in agent workflows because partial model output may be consumed or displayed before full validation, and the documentation does not mention any review or consent controls.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

Streaming Response

bash

curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The streaming example also transmits user prompts and credentials to the remote API. Streaming can increase exposure in agent workflows because partial model output may be consumed or displayed before full validation, and the documentation does not mention any review or consent controls.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

Streaming Response

bash

curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The vision example encourages sending image URLs or base64 image data to a third-party API without any warning about privacy or sensitivity. Images frequently contain highly sensitive material such as screenshots, documents, faces, location data, or proprietary diagrams, so silent off-platform transfer is more dangerous here than plain text prompting.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

Analyze images by passing image URLs or base64 data:

bash

curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The function-calling example sends prompts and tool schemas to the external router. While expected, tool definitions can reveal internal system capabilities or business logic, and the documentation provides no warning that this information is disclosed to a third party.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

Enable tools/functions for structured outputs:

bash

curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The Gemini-native example transmits user content and credentials to the same third-party service using a provider-specific format. The risk is the same as other API examples: silent external disclosure of prompts and possible downstream sharing, without a clear user-facing warning.

Content

Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.

text

```bash
curl -X POST "https://api.aisa.one/v1/models/gemini-2.0-flash:generateContent" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The SDK compatibility example configures a standard OpenAI client to use the third-party base URL, which can make users assume they are talking directly to OpenAI when they are actually sending data to AISA/OpenClaw. That indirection raises transparency and data-governance concerns if not clearly disclosed.

Content

Scanner excerpt · SKILL.md (reported line 434)May include surrounding context.

md

client = OpenAI(
    api_key=os.environ["AISA_API_KEY"],
    base_url="https://api.aisa.one/v1"
)

response = client.chat.completions.create(

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

class LLMRouterClient:
    """Unified LLM Gateway Client for AIsa API."""
    
    BASE_URL = "https://api.aisa.one/v1"
    
    # Popular models for reference (check marketplace.aisa.one/pricing for full list)
    SUPPORTED_MODELS = {

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

md

class LLMRouterClient:
    """Unified LLM Gateway Client for AIsa API."""
    
    BASE_URL = "https://api.aisa.one/v1"
    
    # Popular models for reference (check marketplace.aisa.one/pricing for full list)
    SUPPORTED_MODELS = {

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/llm_router_client.py (reported line 26)May include surrounding context.

python

class LLMRouterClient:
    """Unified LLM Gateway Client for AIsa API."""
    
    BASE_URL = "https://api.aisa.one/v1"
    
    # Popular models for reference (check marketplace.aisa.one/pricing for full list)
    SUPPORTED_MODELS = {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The client unconditionally transmits user-supplied prompts, message histories, and image URLs to a third-party API, but the CLI provides no explicit warning, consent prompt, or data-handling notice. In a skill context, users may assume processing is local, so this can cause accidental disclosure of sensitive prompts, system instructions, or internal image links to an external provider.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill requires an AISA_API_KEY environment variable but gives no guidance on safe credential handling. Users may expose the key through shell history, logs, screenshots, or by hardcoding it into scripts, which could allow unauthorized use of the paid external service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.