Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward YouTube search API helper that sends user-provided searches to AIsa using the configured API key.
Install this only if you are comfortable sending YouTube search terms, country/language filters, and your AISA_API_KEY-authenticated requests to AIsa. Keep the API key scoped and private, and review AIsa's terms and billing because the skill notes per-request cost and remaining credits in responses.
The skill documents network access and use of an environment-stored API key, but it does not declare an explicit tool scope such as allowed-tools or permissions. That mismatch reduces transparency and weakens policy enforcement, making it easier for an agent runtime to grant broader capabilities than reviewers expect.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class YouTubeClient:
"""OpenClaw YouTube - YouTube SERP Scout API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class YouTubeClient:
"""OpenClaw YouTube - YouTube SERP Scout API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class YouTubeClient:
"""OpenClaw YouTube - YouTube SERP Scout API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class YouTubeClient:
"""OpenClaw YouTube - YouTube SERP Scout API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class YouTubeClient:
"""OpenClaw YouTube - YouTube SERP Scout API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class YouTubeClient:
"""OpenClaw YouTube - YouTube SERP Scout API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class YouTubeClient:
"""OpenClaw YouTube - YouTube SERP Scout API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
This code file performs outbound HTTP requests to a third-party API and includes both user-supplied search terms and a bearer token in the request. Although the module docstring describes API usage, there is no explicit warning, confirmation, or user-facing disclosure that queries and metadata are transmitted off-host to api.aisa.one.