Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a legitimate financial-data API skill, but it needs review because its Python client can expose the API key if the API redirects across origins.
Review this before installing. Use a limited, rotatable AIsa API key, monitor credit usage, avoid placing sensitive personal or account data in screener filters or query fields, and prefer host/network controls that restrict egress to the intended API host. The publisher should add explicit permission scope and harden the Python client so authenticated requests do not follow cross-origin redirects with the bearer token attached.
scripts/market_client.py:63Bearer API Key May Be Disclosed Through Cross-Origin HTTP Redirects
The skill declares required binaries and an API key, and its examples clearly perform outbound network requests, but it does not declare an explicit tool scope such as allowed-tools or permissions. This weakens least-privilege controls and can let a host agent invoke broader capabilities than the skill actually needs, increasing the blast radius if the skill is misused or prompt-injected.
This example sends an Authorization bearer token to an external service over the network. While that is expected for an API client skill, it is still a real data-transmission boundary because secrets and user-request parameters leave the local environment and are exposed to a third-party endpoint.
# Historical price data (daily)
curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&interval=day&interval_multiplier=1&start_date=2025-01-01&end_date=2025-12-31" \
-H "Authorization: Bearer $AISA_API_KEY"
# Weekly price data
This example sends an Authorization bearer token to an external service over the network. While that is expected for an API client skill, it is still a real data-transmission boundary because secrets and user-request parameters leave the local environment and are exposed to a third-party endpoint.
# Historical price data (daily)
curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&interval=day&interval_multiplier=1&start_date=2025-01-01&end_date=2025-12-31" \
-H "Authorization: Bearer $AISA_API_KEY"
# Weekly price data
This POST example transmits structured query criteria and a bearer token to a third-party service. Although expected for a stock screener, POST bodies can include richer user-supplied content and therefore increase the chance of sending sensitive or unvalidated data off-platform if an agent passes through arbitrary user filters.
# Screen for stocks matching criteria
curl -X POST "https://api.aisa.one/apis/v1/financial/search/stock" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"filters":{"pe_ratio":{"max":15},"revenue_growth":{"min":0.2}}}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
No suspicious patterns detected.