AIsa Multi Source Search

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:54 AM UTC
• Version: 1.0.0

Overview

This search skill sends user-directed search queries and URLs to a disclosed external API, which fits its purpose but requires privacy caution.

Install this only if you are comfortable sending search terms, supplied URLs, retrieved result payloads, and your AISA API key to the external AISA service and Tavily-backed endpoints. Avoid confidential queries and do not use the extract, crawl, or map features on private, internal, authenticated, signed, or token-bearing URLs unless you have explicit authorization and understand the provider's data handling and costs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares required environment variables and clearly documents networked API usage, but it does not declare an explicit tool scope such as allowed tools or permissions. This creates a transparency and governance gap: agents may invoke network access and use secrets without users or policy systems getting a precise permission boundary.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Basic web search
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/web?query=AI+frameworks&max_num_results=10" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Full text search (with page content)

• Confidence: 90% confidence
• Finding: The example sends search queries and an API bearer token to an external service over the network. This is expected for a search skill, but it still represents real external data transmission risk if user queries contain sensitive information or if operators do not understand that prompts/content leave the local environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Basic web search
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/web?query=AI+frameworks&max_num_results=10" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Full text search (with page content)

• Confidence: 90% confidence
• Finding: The example sends search queries and an API bearer token to an external service over the network. This is expected for a search skill, but it still represents real external data transmission risk if user queries contain sensitive information or if operators do not understand that prompts/content leave the local environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AISA_API_KEY"

# Full text search (with page content)
curl -X POST "https://api.aisa.one/apis/v1/search/full?query=latest+AI+news&max_num_results=10" \
  -H "Authorization: Bearer $AISA_API_KEY"
```

• Confidence: 88% confidence
• Finding: The full-text search example indicates that page content, not just a query string, may be retrieved and processed by an external API. This increases sensitivity because user-driven searches can cause more substantive third-party content handling, with possible exposure of private or copyrighted material depending on usage context.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Search academic papers
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=transformer+models&max_num_results=10" \
  -H "Authorization: Bearer $AISA_API_KEY"

# With year filter

• Confidence: 86% confidence
• Finding: Academic search requests transmit user queries and authorization credentials to an external provider. Although normal for this skill’s purpose, the risk remains that confidential research topics, internal project names, or sensitive investigations could be disclosed to the service.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AISA_API_KEY"

# With year filter
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=LLM&max_num_results=10&as_ylo=2024&as_yhi=2025" \
  -H "Authorization: Bearer $AISA_API_KEY"
```

• Confidence: 85% confidence
• Finding: The year-filtered scholar request is another external transmission of user intent and credentials to a third party. The context is legitimate, but the skill lacks accompanying disclosure or safeguards about what search content is appropriate to send externally.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Intelligent hybrid search
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/smart?query=machine+learning+optimization&max_num_results=10" \
  -H "Authorization: Bearer $AISA_API_KEY"
```

• Confidence: 87% confidence
• Finding: The smart-search endpoint combines search modes and still transmits user queries externally, potentially broadening the amount of processed user intent and retrieved content. Without clear controls, users may unintentionally expose sensitive topics to a third-party service.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation encourages URL extraction, crawling, and mapping of user-supplied targets through an external service, but it does not warn that submitted URLs, page content, and crawl targets will be transmitted to a third party. This can expose sensitive internal URLs, tokens embedded in URLs, proprietary documents, or regulated data if users pass private resources.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Tavily search
curl -X POST "https://api.aisa.one/apis/v1/tavily/search" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query":"latest AI developments"}'

• Confidence: 90% confidence
• Finding: The Tavily search example sends user-provided search terms to the external API, potentially involving a downstream third-party integration as well. This compounds data-sharing concerns because users may not realize both the fronting API and integrated search provider may process their input.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"query":"latest AI developments"}'

# Extract content from URLs
curl -X POST "https://api.aisa.one/apis/v1/tavily/extract" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"urls":["https://example.com/article"]}'

• Confidence: 96% confidence
• Finding: The extract endpoint accepts arbitrary URLs and sends them to an external service for content retrieval. This is more dangerous than ordinary search because users may submit private, signed, intranet, or token-bearing URLs, causing unintended disclosure of protected resources or metadata to a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"urls":["https://example.com/article"]}'

# Crawl web pages
curl -X POST "https://api.aisa.one/apis/v1/tavily/crawl" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com","max_depth":2}'

• Confidence: 97% confidence
• Finding: The crawl endpoint enables third-party crawling of arbitrary user-specified URLs and depths, which can amplify exposure beyond a single page into entire sites or application areas. In the absence of safeguards, this can leak internal structure, collect sensitive content, or trigger unwanted scanning of non-public resources.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"url":"https://example.com","max_depth":2}'

# Site map
curl -X POST "https://api.aisa.one/apis/v1/tavily/map" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

• Confidence: 94% confidence
• Finding: Site-map generation for arbitrary URLs still transmits target locations to an external provider and may reveal site structure or sensitive endpoints if used on private resources. The skill presents this capability without any warning about sending user-supplied targets externally.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Generate explanations with confidence scoring
curl -X POST "https://api.aisa.one/apis/v1/scholar/explain" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"results":[...],"language":"en","format":"summary"}'

• Confidence: 89% confidence
• Finding: The explain endpoint sends a `results` payload to an external API for synthesis, which may include substantial retrieved text, citations, and potentially sensitive intermediate data. This increases exposure compared with a simple query because aggregated search outputs are being forwarded for third-party analysis.

External Transmission

Medium

• Category: Data Exfiltration

Content

class SearchClient:
    """OpenClaw Search - Web and Academic Search API Client with Confidence Scoring."""
    
    BASE_URL = "https://api.aisa.one/apis/v1"
    
    def __init__(self, api_key: Optional[str] = None):
        """Initialize the client with an API key."""

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This code file sends user-supplied search queries and URL lists to a remote API via HTTP requests, including commands like web search, Tavily extract, crawl, and map. While the module docstrings describe functionality, there is no explicit user-facing warning, confirmation, or privacy disclosure that user inputs will be transmitted to external services.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is described as a unified search client, but it also exposes URL extraction, crawling, and site-mapping operations that materially expand its capabilities beyond simple search. This increases data-access and reconnaissance functionality, which can be misused to fetch and enumerate arbitrary sites without that broader behavior being clearly justified by the stated skill purpose.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Crawling and site-mapping enable broader collection and enumeration of external content than a normal search helper requires. In an agent context, these features can be repurposed for unintended reconnaissance, large-scale data gathering, or accessing sensitive internal URLs if upstream controls are weak.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: SQP-3 applies to natural-language policy violations in all file types. This example explicitly fixes the output language to English, which can conflict with language/locale policies when the skill does not mention that users can select a different language or that English is optional.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The client accesses the AISA_API_KEY environment variable to authenticate requests. Although the error message explains that the variable is required, the skill does not provide a broader warning that it consumes credentials from the environment and uses them for outbound requests.

Static analysis

No suspicious patterns detected.