AIsa Youtube Search

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to be a straightforward YouTube search client that uses an AIsa API key and does not show hidden persistence, destructive behavior, or unrelated data access.

Before installing, confirm you trust AIsa/OpenClaw, use a dedicated AISA_API_KEY if possible, and avoid sending sensitive search terms. The provided artifacts otherwise look purpose-aligned and proportionate for YouTube SERP research.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Searches may consume the user's AIsa API quota or billing and are performed under the user's API account.

Why it was flagged

The client requires an AIsa API key and sends it as a bearer token to the AIsa API; this is expected for the service but is still delegated account authority.

Skill content

self.api_key = api_key or os.environ.get("AISA_API_KEY") ... "Authorization": f"Bearer {self.api_key}"

Recommendation

Use a dedicated API key if possible, keep it in the environment rather than hardcoding it, and rotate or revoke it when no longer needed.

Note

ASI02: Tool Misuse and Exploitation

What this means

Search terms, country/language filters, and filter tokens are sent to the external AIsa API.

Why it was flagged

The skill performs network API calls using user-supplied search parameters. This matches the stated YouTube search purpose, but users should understand that queries leave the local environment.

Skill content

BASE_URL = "https://api.aisa.one/apis/v1" ... return self._request("GET", "/youtube/search", params=params)

Recommendation

Avoid putting private or sensitive information into search queries unless you are comfortable sending it to the API provider.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have less provenance information for independently verifying the skill's origin.

Why it was flagged

The registry metadata does not identify a source repository or provenance beyond the listed homepage, although the supplied artifacts do not show risky install behavior.

Skill content

Source: unknown

Recommendation

Install only if you trust the publisher and the AIsa/OpenClaw provider relationship; prefer a version with a clear source repository when available.