Security audit
Security checks for vulnerabilities and agentic risk
This search skill sends user-directed search queries and URLs to a disclosed external API, which fits its purpose but requires privacy caution.
Install this only if you are comfortable sending search terms, supplied URLs, retrieved result payloads, and your AISA API key to the external AISA service and Tavily-backed endpoints. Avoid confidential queries and do not use the extract, crawl, or map features on private, internal, authenticated, signed, or token-bearing URLs unless you have explicit authorization and understand the provider's data handling and costs.
The skill declares required environment variables and clearly documents networked API usage, but it does not declare an explicit tool scope such as allowed tools or permissions. This creates a transparency and governance gap: agents may invoke network access and use secrets without users or policy systems getting a precise permission boundary.
The example sends search queries and an API bearer token to an external service over the network. This is expected for a search skill, but it still represents real external data transmission risk if user queries contain sensitive information or if operators do not understand that prompts/content leave the local environment.
# Basic web search
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/web?query=AI+frameworks&max_num_results=10" \
-H "Authorization: Bearer $AISA_API_KEY"
# Full text search (with page content)
The example sends search queries and an API bearer token to an external service over the network. This is expected for a search skill, but it still represents real external data transmission risk if user queries contain sensitive information or if operators do not understand that prompts/content leave the local environment.
# Basic web search
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/web?query=AI+frameworks&max_num_results=10" \
-H "Authorization: Bearer $AISA_API_KEY"
# Full text search (with page content)
The full-text search example indicates that page content, not just a query string, may be retrieved and processed by an external API. This increases sensitivity because user-driven searches can cause more substantive third-party content handling, with possible exposure of private or copyrighted material depending on usage context.
-H "Authorization: Bearer $AISA_API_KEY"
curl -X POST "https://api.aisa.one/apis/v1/search/full?query=latest+AI+news&max_num_results=10"
-H "Authorization: Bearer $AISA_API_KEY"
Academic search requests transmit user queries and authorization credentials to an external provider. Although normal for this skill’s purpose, the risk remains that confidential research topics, internal project names, or sensitive investigations could be disclosed to the service.
# Search academic papers
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=transformer+models&max_num_results=10" \
-H "Authorization: Bearer $AISA_API_KEY"
# With year filter
The year-filtered scholar request is another external transmission of user intent and credentials to a third party. The context is legitimate, but the skill lacks accompanying disclosure or safeguards about what search content is appropriate to send externally.
-H "Authorization: Bearer $AISA_API_KEY"
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=LLM&max_num_results=10&as_ylo=2024&as_yhi=2025"
-H "Authorization: Bearer $AISA_API_KEY"
The smart-search endpoint combines search modes and still transmits user queries externally, potentially broadening the amount of processed user intent and retrieved content. Without clear controls, users may unintentionally expose sensitive topics to a third-party service.
# Intelligent hybrid search
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/smart?query=machine+learning+optimization&max_num_results=10" \
-H "Authorization: Bearer $AISA_API_KEY"
The documentation encourages URL extraction, crawling, and mapping of user-supplied targets through an external service, but it does not warn that submitted URLs, page content, and crawl targets will be transmitted to a third party. This can expose sensitive internal URLs, tokens embedded in URLs, proprietary documents, or regulated data if users pass private resources.
The Tavily search example sends user-provided search terms to the external API, potentially involving a downstream third-party integration as well. This compounds data-sharing concerns because users may not realize both the fronting API and integrated search provider may process their input.
# Tavily search
curl -X POST "https://api.aisa.one/apis/v1/tavily/search" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query":"latest AI developments"}'
The extract endpoint accepts arbitrary URLs and sends them to an external service for content retrieval. This is more dangerous than ordinary search because users may submit private, signed, intranet, or token-bearing URLs, causing unintended disclosure of protected resources or metadata to a third party.
-d '{"query":"latest AI developments"}'
# Extract content from URLs
curl -X POST "https://api.aisa.one/apis/v1/tavily/extract" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"urls":["https://example.com/article"]}'
The crawl endpoint enables third-party crawling of arbitrary user-specified URLs and depths, which can amplify exposure beyond a single page into entire sites or application areas. In the absence of safeguards, this can leak internal structure, collect sensitive content, or trigger unwanted scanning of non-public resources.
-d '{"urls":["https://example.com/article"]}'
# Crawl web pages
curl -X POST "https://api.aisa.one/apis/v1/tavily/crawl" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url":"https://example.com","max_depth":2}'
Site-map generation for arbitrary URLs still transmits target locations to an external provider and may reveal site structure or sensitive endpoints if used on private resources. The skill presents this capability without any warning about sending user-supplied targets externally.
-d '{"url":"https://example.com","max_depth":2}'
# Site map
curl -X POST "https://api.aisa.one/apis/v1/tavily/map" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url":"https://example.com"}'
The explain endpoint sends a results payload to an external API for synthesis, which may include substantial retrieved text, citations, and potentially sensitive intermediate data. This increases exposure compared with a simple query because aggregated search outputs are being forwarded for third-party analysis.
# Generate explanations with confidence scoring
curl -X POST "https://api.aisa.one/apis/v1/scholar/explain" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"results":[...],"language":"en","format":"summary"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class SearchClient:
"""OpenClaw Search - Web and Academic Search API Client with Confidence Scoring."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
This code file sends user-supplied search queries and URL lists to a remote API via HTTP requests, including commands like web search, Tavily extract, crawl, and map. While the module docstrings describe functionality, there is no explicit user-facing warning, confirmation, or privacy disclosure that user inputs will be transmitted to external services.
The skill is described as a unified search client, but it also exposes URL extraction, crawling, and site-mapping operations that materially expand its capabilities beyond simple search. This increases data-access and reconnaissance functionality, which can be misused to fetch and enumerate arbitrary sites without that broader behavior being clearly justified by the stated skill purpose.
Crawling and site-mapping enable broader collection and enumeration of external content than a normal search helper requires. In an agent context, these features can be repurposed for unintended reconnaissance, large-scale data gathering, or accessing sensitive internal URLs if upstream controls are weak.
SQP-3 applies to natural-language policy violations in all file types. This example explicitly fixes the output language to English, which can conflict with language/locale policies when the skill does not mention that users can select a different language or that English is optional.
The client accesses the AISA_API_KEY environment variable to authenticate requests. Although the error message explains that the variable is required, the skill does not provide a broader warning that it consumes credentials from the environment and uses them for outbound requests.
No suspicious patterns detected.