ClawHub
Back to skill

Security audit

AIsa Provider

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent AIsa provider setup guide, but it needs Review because it routes model traffic to a third-party service and gives unsafe API-key handling examples without enough warning.

Install only if you intend to use AIsa as a model provider and are comfortable sending model requests through AIsa. Prefer the interactive onboarding flow or a secure credential store, avoid putting real API keys in command-line arguments or shell history, and review your OpenClaw defaults so sensitive workloads do not route to this provider unintentionally.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:59
Finding

API Key Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59-62
Vulnerability Type: API key disclosure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

bash
openclaw onboard --auth-choice aisa-api-key --aisa-api-key "your-key-here"

Technical Analysis

The documented setup procedure instructs users to place an AIsa API key directly in a command-line argument. When a real key replaces the placeholder, the secret may be exposed through:

  • Shell history files
  • Process-listing and process-monitoring tools
  • Terminal session recordings
  • Endpoint audit and command telemetry
  • Debug logs or diagnostic bundles

Although the repository contains only a placeholder and no hardcoded credential, users following this workflow would expose an operational secret through an unsafe input channel.

Attack Path

  1. A user replaces your-key-here with a valid AIsa API key and executes the documented command.
  2. The command is retained in shell history, captured by terminal or audit logging, or temporarily exposed in the process argument list.
  3. A local user, monitoring agent, administrator of a shared environment, or party with access to collected logs retrieves the key.
  4. The party submits authenticated requests to the AIsa API using the compromised credential.
  5. The key remains usable until it is revoked, rotated, expires, or reaches an account-side limit.

Impact Assessment

Exploitation does not directly grant operating-system privileges. It grants the access associated with the compromised AIsa credential, potentially allowing unauthorized model requests, consumption of paid quota, exposure of account-level API capabilities, and service disruption through quota exhaustion. Scope is limited by the permissions, billing controls, rate limits, and lifecycle of the exposed key.

Remediation
View remediation

Remediation Suggestions

  • Remove the command-line option that accepts the API key directly from the documentation.

  • Prefer an interactive secret prompt that disables terminal echo and does not preserve the value in history.

  • Alternatively, accept the key through standard input or a credential manager supported by the runtime.

  • If environment variables are used, document a method that avoids placing the secret in shell history, such as reading it silently:

    bash
    read -rsp "AIsa API key: " AISA_API_KEY
echo
export AISA_API_KEY

  • Warn users not to put real keys in command-line arguments, committed configuration files, shell startup files with weak permissions, screenshots, or support logs.

  • Recommend immediate key revocation and rotation if the unsafe command has already been used in a logged or shared environment.

  • Ensure diagnostic and telemetry systems redact credential-bearing arguments.

T09 · Insecure Skill Coding Practices

Warning
Location
references/guide-zh-CN.md:27
Finding

API Key Exposed Through Command-Line Arguments in Chinese Setup Guide

Content
View full analysis

Vulnerability Details

File Location: references/guide-zh-CN.md, lines 27-31
Vulnerability Type: API key disclosure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

bash
openclaw onboard --auth-choice aisa-api-key --aisa-api-key "你的密钥"

Technical Analysis

The localized setup guide independently repeats the unsafe recommendation to pass an API key as a command-line argument. Replacing the placeholder with a valid secret can expose that secret through shell history, process inspection, terminal capture, audit systems, and diagnostic logs.

The placeholder itself is not a leaked credential. The risk arises when users follow the documented procedure with an operational API key.

Attack Path

  1. A user substitutes a valid API key into the documented onboarding command.
  2. The command and key are recorded in shell history or operational telemetry, or observed in the process argument list while onboarding runs.
  3. A party with local access or access to the resulting logs extracts the credential.
  4. The party reuses the key against AIsa’s API endpoint.
  5. Unauthorized usage continues until the credential is restricted, revoked, rotated, or exhausted.

Impact Assessment

The exposed key may permit unauthorized API requests and paid-quota consumption under the victim’s account. An attacker could cause unexpected charges or exhaust available limits, affecting service availability. The finding does not by itself provide host-level privilege escalation; effective access is bounded by the API key’s privileges and account controls.

Remediation
View remediation

Remediation Suggestions

  • Remove the localized command example that embeds the API key in an argument.
  • Replace it with a hidden interactive prompt, standard-input workflow, or supported credential-store integration.
  • If environment-variable setup is retained, provide a history-safe procedure rather than an export command containing the literal key.
  • Add an explicit warning that secrets passed on the command line may be visible to local process inspection and retained by history or telemetry.
  • Keep security guidance consistent across all localized documentation to prevent users from selecting the less secure workflow.
  • Advise users who already followed this procedure in shared or monitored environments to delete relevant history where feasible and revoke and rotate the affected key.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The invocation guidance is broad enough to trigger on many common user intents such as pricing questions, model switching, setup help, or even mention of an environment variable. In an agent ecosystem, this can cause the skill to activate outside narrowly intended scenarios, increasing the chance that its instructions or bundled assets influence responses when another tool or workflow would be more appropriate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill's activation criteria are very broad, including generic requests like pricing comparisons, troubleshooting, model switching, and mentions of an API key. In an agentic environment, this can cause the skill to auto-trigger in contexts where users did not explicitly request this provider, increasing the chance of steering users toward a third-party service and exposing configuration details or credentials unnecessarily.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This configuration directs the runtime to send prompts and associated model traffic to an external third-party endpoint, https://api.aisa.one/v1, using an API key. That is inherently security-relevant because user data, prompts, and possibly sensitive context may be transmitted off-platform; the claimed privacy guarantees in the document are marketing assertions and should not be treated as technical enforcement.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md
"models": {
    "providers": {
      "aisa": {
        "baseUrl": "https://api.aisa.one/v1",
        "apiKey": "${AISA_API_KEY}",
        "api": "openai-completions",
        "models": [

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The example curl command sends the bearer token to an external service to enumerate models. Even though this is a normal API call, including it in a skill can encourage users or agents to transmit credentials and interact with a remote endpoint without sufficient notice about data exposure, logging, or trust boundaries.

Content

Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.

List all available models:

bash
curl https://api.aisa.one/v1/models -H "Authorization: Bearer $AISA_API_KEY"

Model ID Versioning

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This repeated curl example again instructs use of a bearer token against an external endpoint. Repetition increases the likelihood that automated agents or users will execute it reflexively, creating unnecessary credential exposure and remote interaction risk in environments where outbound requests should be tightly controlled.

Content

Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.

To check the latest available model IDs:

bash
curl https://api.aisa.one/v1/models -H "Authorization: Bearer $AISA_API_KEY"

Switching Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 376)May include surrounding context.

md
"models": {
    "providers": {
      "aisa": {
        "baseUrl": "https://api.aisa.one/v1",
        "apiKey": "${AISA_API_KEY}",
        "api": "openai-completions",
        "models": [

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/config-examples.md (reported line 20)May include surrounding context.

md
"models": {
    "providers": {
      "aisa": {
        "baseUrl": "https://api.aisa.one/v1",
        "apiKey": "${AISA_API_KEY}",
        "api": "openai-completions",
        "models": [

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/config-examples.md (reported line 134)May include surrounding context.

md
"models": {
    "providers": {
      "aisa": {
        "baseUrl": "https://api.aisa.one/v1",
        "apiKey": "${AISA_API_KEY}",
        "api": "openai-completions",
        "models": [

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/guide-zh-CN.md (reported line 88)May include surrounding context.

md
"models": {
    "providers": {
      "aisa": {
        "baseUrl": "https://api.aisa.one/v1",
        "apiKey": "${AISA_API_KEY}",
        "api": "openai-completions",
        "models": [

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The configuration instructs users to send requests to a third-party API endpoint using an API key, but the documentation does not clearly warn that prompts, files, and other model inputs may be transmitted off-platform to AIsa. In a provider-setup skill, this omission can lead users to unknowingly expose sensitive business or personal data to an external service under different retention, logging, or jurisdictional controls.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.