AIsa Youtube Search

• Analyzed: May 8, 2026, 1:01 PM
• Findings: 0
• Version: 1.0.1
• Hash: 3161935fe1fcb9ebf6a3060774becd84e135503aaec13168691b185009b4c234
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: aisa-youtube-search-aisa-api Version: 1.0.1 The skill is a straightforward wrapper for the AIsa YouTube Search API (api.aisa.one). It provides instructions for an AI agent to perform YouTube searches using curl and a dedicated API key (AISA_API_KEY). The documentation in SKILL.md and README.md is transparent about data being sent to the third-party endpoint and includes appropriate guardrails against requesting sensitive user credentials like Google cookies.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

Note

What this means

Anyone with the API key could make requests to the AIsa service as the key holder.

Why it was flagged

The skill requires a provider API key and sends it as a bearer token to the AIsa endpoint. This is purpose-aligned and disclosed, but it is still a sensitive credential.

Skill content

Required environment variable: `AISA_API_KEY` ... -H "Authorization: Bearer $AISA_API_KEY"

Recommendation

Store the key securely, avoid pasting it into shared logs or chats, and rotate it if it is exposed.

ASI07: Insecure Inter-Agent Communication

Note

What this means

YouTube search queries may be visible to the external relay service.

Why it was flagged

The skill explicitly relies on an external relay, so search terms and filter parameters are sent to AIsa rather than staying local.

Skill content

All search requests go to `api.aisa.one`.

Recommendation

Use the skill only for searches you are comfortable sending to AIsa; choose another method if the query must remain local or private.