Security audit
Security checks for vulnerabilities and agentic risk
MarketPulse is a disclosed financial-market data skill that sends user-requested stock and crypto queries to the AIsa API using the user's API key.
Install only if you are comfortable sharing your AISA_API_KEY and requested tickers, date ranges, and screener filters with AIsa. API calls may consume paid credits, so use a dedicated key with limited credit exposure where possible.
The skill requires environment access for AISA_API_KEY and performs network calls, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a governance gap where an agent runtime may grant broader capabilities than users expect, increasing the risk of unreviewed outbound requests and secret use.
This example sends authenticated requests to an external domain using Authorization: Bearer $AISA_API_KEY, which means the skill is designed to transmit a sensitive credential off-platform. While this appears necessary for the product's function, it still creates real risk if the endpoint is compromised, misconfigured, or if users do not understand that their key and query data are being sent externally.
# Historical price data (daily)
curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&interval=day&interval_multiplier=1&start_date=2025-01-01&end_date=2025-12-31" \
-H "Authorization: Bearer $AISA_API_KEY"
# Weekly price data
This example sends authenticated requests to an external domain using Authorization: Bearer $AISA_API_KEY, which means the skill is designed to transmit a sensitive credential off-platform. While this appears necessary for the product's function, it still creates real risk if the endpoint is compromised, misconfigured, or if users do not understand that their key and query data are being sent externally.
# Historical price data (daily)
curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&interval=day&interval_multiplier=1&start_date=2025-01-01&end_date=2025-12-31" \
-H "Authorization: Bearer $AISA_API_KEY"
# Weekly price data
This POST example transmits structured filter data to an external service under bearer-token authentication. Although the data shown is innocuous, POST bodies can carry user-supplied screening criteria or proprietary analysis parameters, so the skill enables external disclosure of potentially sensitive financial intent and account-billed activity.
# Screen for stocks matching criteria
curl -X POST "https://api.aisa.one/apis/v1/financial/search/stock" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"filters":{"pe_ratio":{"max":15},"revenue_growth":{"min":0.2}}}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class MarketClient:
"""OpenClaw Market - Unified Market Data API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
No suspicious patterns detected.