Chines LLM Models (MiniMax 2.5,Kimi 2.5, Qwen, Doubao, DeepSeek) with one key

ReviewAudited by ClawScan on May 1, 2026.

Overview

This is a coherent instruction-only setup for an AIsa model provider; the main things to watch are API-key handling, external prompt routing, and verifying privacy/cost claims.

Install this only if you intend to route OpenClaw model calls through AIsa. Get the API key from the official AIsa site, store it securely, avoid exposing it in command history, verify current pricing and privacy/ZDR terms, and be aware that setting AIsa as the default model affects future sessions.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone who obtains the key could use the AIsa account or consume paid quota.

Why it was flagged

The skill requires an AIsa API credential, and one optional command passes the key directly on the command line, which can expose it through shell history or process visibility.

Skill content
export AISA_API_KEY="your-key-here" ... openclaw onboard --auth-choice aisa-api-key --aisa-api-key "your-key-here"
Recommendation

Prefer interactive onboarding or secure environment/secret storage, avoid putting real keys in shared logs, and rotate the key if it is exposed.

What this means

Prompts, code, files included in context, and generated outputs may be sent to AIsa and downstream model providers when this provider is used.

Why it was flagged

The provider configuration sends model requests through AIsa's remote API gateway using the user's API key.

Skill content
"baseUrl": "https://api.aisa.one/v1", "apiKey": "${AISA_API_KEY}"
Recommendation

Only use it for data you are allowed to send to that provider, and review AIsa's current privacy, retention, and regional processing terms before sending sensitive information.

What this means

A user might send more sensitive data than intended if they treat the marketing-style privacy statement as sufficient proof.

Why it was flagged

The artifacts make strong privacy assurances; they may be true, but users should verify the actual agreement and terms rather than relying only on the skill text.

Skill content
用户完全不用担心数据隐私问题。AIsa 已与月之暗面签署正式的零数据留存协议。
Recommendation

Verify the provider's current ZDR/privacy documentation and contractual coverage before using it for confidential workloads.

What this means

Future OpenClaw sessions may route through AIsa and incur costs until the default model is changed back.

Why it was flagged

The manual configuration example changes the default OpenClaw model to AIsa, which is purpose-aligned but affects future agent behavior if applied.

Skill content
"agents": { "defaults": { "model": { "primary": "aisa/qwen3-max" } } }
Recommendation

Apply the default-model change only if intended, consider backing up the config file, and use per-session model selection when testing.