Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed third-party search client that sends user queries and URLs to AIsa/Tavily APIs, with no evidence of hidden persistence or unrelated data access.
Install only if you are comfortable sending search terms, URL targets, retrieved result sets, and crawl or site-map requests to the AIsa API and its Tavily-backed endpoints. Avoid using it with secrets, confidential internal research, private URLs, localhost, internal network hosts, or access-controlled pages unless your organization has approved that data sharing.
The skill advertises network access and use of an API key via metadata (env and remote curl/Python examples), but it does not declare an explicit tool scope such as allowed tools or permissions. This can cause operators or agent frameworks to underconstrain execution, making it easier for the skill to send user queries and URLs off-platform without clear policy visibility.
This example sends search queries and an authorization token to api.aisa.one, which is a clear external transmission path. In the context of an agent skill, user-provided searches may contain sensitive business, personal, or internal research data, so outbound transmission to a third party is a genuine data-exposure risk if not clearly governed.
# Basic web search
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/web?query=AI+frameworks&max_num_results=10" \
-H "Authorization: Bearer $AISA_API_KEY"
# Full text search (with page content)
This example sends search queries and an authorization token to api.aisa.one, which is a clear external transmission path. In the context of an agent skill, user-provided searches may contain sensitive business, personal, or internal research data, so outbound transmission to a third party is a genuine data-exposure risk if not clearly governed.
# Basic web search
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/web?query=AI+frameworks&max_num_results=10" \
-H "Authorization: Bearer $AISA_API_KEY"
# Full text search (with page content)
The full-text search example transmits queries to an external API and explicitly requests page content, increasing the volume and sensitivity of data processed remotely. In context, this is more dangerous than ordinary search because retrieved content may include copyrighted, internal, or sensitive text that is then handled by the provider.
-H "Authorization: Bearer $AISA_API_KEY"
curl -X POST "https://api.aisa.one/apis/v1/search/full?query=latest+AI+news&max_num_results=10"
-H "Authorization: Bearer $AISA_API_KEY"
The scholar search example sends research queries to an external provider with bearer-token authentication. While expected for a search skill, this is still a real confidentiality concern because academic or product research prompts can reveal strategic intent, internal projects, or proprietary interests.
# Search academic papers
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=transformer+models&max_num_results=10" \
-H "Authorization: Bearer $AISA_API_KEY"
# With year filter
This scholar search variant includes structured query parameters and still transmits the search terms externally. The additional filters do not reduce the core risk; the user's research interests and timing constraints may still disclose sensitive planning or analysis activity.
-H "Authorization: Bearer $AISA_API_KEY"
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=LLM&max_num_results=10&as_ylo=2024&as_yhi=2025"
-H "Authorization: Bearer $AISA_API_KEY"
The smart search endpoint combines retrieval modes, which may amplify the amount of user intent and derived context sent to the provider. In an agent workflow, richer search orchestration can make the privacy impact larger because more contextualized or sensitive investigative queries are disclosed externally.
# Intelligent hybrid search
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/smart?query=machine+learning+optimization&max_num_results=10" \
-H "Authorization: Bearer $AISA_API_KEY"
The skill promotes external search, extraction, crawl, and map operations against third-party services but does not prominently warn that user queries, supplied URLs, and potentially sensitive targets will be transmitted to external infrastructure. In an agent setting, this creates a real privacy and data-governance risk because users may assume local processing while the skill exfiltrates prompts, URLs, and retrieved content to remote APIs.
The Tavily search integration sends user queries through the vendor's API stack, introducing an additional third-party data-sharing path. This is materially relevant because users may not realize their prompts are leaving the local agent environment and may also be processed by downstream integrated services.
# Tavily search
curl -X POST "https://api.aisa.one/apis/v1/tavily/search" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query":"latest AI developments"}'
The extract endpoint accepts arbitrary URLs and sends them to an external service for content retrieval, which can expose internal, private, or access-controlled URLs if the skill is used carelessly. In an agent context this is more dangerous than normal web search because it can be turned into unintended third-party access, internal resource disclosure, or exfiltration of targeted page content.
-d '{"query":"latest AI developments"}'
# Extract content from URLs
curl -X POST "https://api.aisa.one/apis/v1/tavily/extract" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"urls":["https://example.com/article"]}'
The crawl endpoint instructs a third-party service to recursively fetch a target URL, which can magnify data exposure and create unintended scanning of private or sensitive sites. Because crawling follows links and increases request volume, misuse could disclose internal site structure or trigger unauthorized collection far beyond a single user-intended page.
-d '{"urls":["https://example.com/article"]}'
# Crawl web pages
curl -X POST "https://api.aisa.one/apis/v1/tavily/crawl" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url":"https://example.com","max_depth":2}'
The site-map operation can reveal the structure of a target website to an external service, which is especially sensitive if users provide internal or non-public URLs. In the skill context, this is more dangerous than ordinary search because mapping can enumerate endpoints and content organization, increasing reconnaissance risk.
-d '{"url":"https://example.com","max_depth":2}'
# Site map
curl -X POST "https://api.aisa.one/apis/v1/tavily/map" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url":"https://example.com"}'
The explain endpoint sends a results payload to an external API for meta-analysis, which may include previously retrieved content, summaries, or citations derived from sensitive sources. This increases exposure because the skill is not only transmitting the original query but also potentially large bodies of aggregated content to a third party.
# Generate explanations with confidence scoring
curl -X POST "https://api.aisa.one/apis/v1/scholar/explain" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"results":[...],"language":"en","format":"summary"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class SearchClient:
"""OpenClaw Search - Web and Academic Search API Client with Confidence Scoring."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
The skill metadata advertises unified search over web, academic, and Tavily, but the implementation also exposes active crawling and site-mapping endpoints. That capability expansion matters for agent security because operators may grant or invoke the skill expecting passive search only, while the skill can perform broader reconnaissance against arbitrary sites and collect more data than its description suggests.
The documented example for the explain endpoint includes a fixed language parameter of "en". Because the documentation does not mention that language is configurable or selected based on user preference, it suggests an English-only default that may violate language/locale policy expectations.
No suspicious patterns detected.