Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed YouTube search client that sends user search parameters and its own AISA API key to the AISA relay, with no evidence of hidden persistence, local data harvesting, or unsafe execution.
Install only if you are comfortable sending YouTube search queries, country/language parameters, and your AISA API key to the AISA relay. Do not use it for private queries you would not share with that service, and provide only the dedicated AISA_API_KEY rather than broader credentials.
Referenced artifact was not completely inspected
- The release bundle is runtime-only: it keeps `SKILL.md` and `scripts/youtube_client.py`, while omitting non-runtime files such as `README.md` and `_meta.json`
The skill declares runtime requirements that imply access to environment variables and outbound network usage, but it does not explicitly constrain tool scope with permissions or allowed-tools metadata. In agent ecosystems, this ambiguity can lead to over-broad execution privileges, making it easier for the skill to access secrets like AISA_API_KEY and transmit data externally without clear policy boundaries.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class YouTubeClient:
"""OpenClaw YouTube - YouTube SERP Scout API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class YouTubeClient:
"""OpenClaw YouTube - YouTube SERP Scout API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
The manifest describes a YouTube search and SERP analysis skill, but does not mention handling local credentials or environment access. The code pulls AISA_API_KEY from process environment state, which is a broader capability than pure search/query behavior, even though it is used only for authentication.
This code file sends query, country, and language values to a remote service at api.aisa.one, which is a network operation involving user-provided data. While the script's purpose is YouTube search, there is no explicit disclosure in comments, help text, or runtime output that the provided inputs are sent to a third-party API.
No suspicious patterns detected.