Intelligent Search Agent

• Outcome: Pass
• Latest audit: May 28, 2026 · 10:48 AM UTC
• Version: 1.0.2

Overview

This is a coherent external search skill, but users should know that searches, prompts, and URLs are sent to AIsa-backed services.

Install only if you trust the AIsa/OpenClaw search service and are comfortable using an AISA_API_KEY. Avoid sending secrets, customer data, confidential research, internal URLs, signed links, or non-public sites unless your organization has approved sharing that data with the external API provider.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill explicitly requires an environment variable API key and documents extensive outbound HTTP requests, yet there is no clear declared permission model for environment access or network use. This weakens user and platform visibility into sensitive capabilities and can lead to silent use of credentials and remote data transmission.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The skill is described as a search tool, but the documented behavior also includes crawling sites, generating site maps, explanation/summarization, and a custom multi-source aggregation workflow. This broader behavior increases the operational and privacy footprint beyond what a user may reasonably infer from the description, creating consent and trust issues.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation repeatedly instructs sending user queries, prompts, and target URLs to a third-party API endpoint without an explicit privacy warning or data-handling notice. In agent settings, users may unknowingly transmit sensitive research topics, internal URLs, or proprietary text to an external provider, which creates confidentiality and compliance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Sonar

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 92% confidence
• Finding: This endpoint sends user message content to an external Perplexity/Sonar API through AIsa using an authenticated bearer token. The transmission itself is expected for the feature, but it is still security-relevant because prompts may contain sensitive data and the skill does not present an explicit warning or restriction.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Web Search

```bash
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/web?query=AI+frameworks&max_num_results=10" \
  -H "Authorization: Bearer $AISA_API_KEY"
```

• Confidence: 90% confidence
• Finding: The web search example transmits the user's query to an external AIsa endpoint over the network. While consistent with a search skill, this still exposes user interests or sensitive terms to a third party if no disclosure or input-sensitivity controls are present.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Scholar Search

```bash
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=transformer+models&max_num_results=10" \
  -H "Authorization: Bearer $AISA_API_KEY"

curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=LLM&max_num_results=10&as_ylo=2024&as_yhi=2025" \

• Confidence: 90% confidence
• Finding: The scholar search endpoint sends research queries to an external service, which may reveal confidential project areas, unpublished topics, or internal investigation themes. In an enterprise or agent context, that data exposure is a genuine privacy and compliance concern if not clearly disclosed.

External Transmission

Medium

• Category: Data Exfiltration

Content

curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=transformer+models&max_num_results=10" \
  -H "Authorization: Bearer $AISA_API_KEY"

curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=LLM&max_num_results=10&as_ylo=2024&as_yhi=2025" \
  -H "Authorization: Bearer $AISA_API_KEY"
```

• Confidence: 90% confidence
• Finding: This second scholar search example also transmits query parameters, including topical and time-bounded research intent, to an external API. The risk is not code execution but unauthorized external disclosure of user-supplied information without explicit notice.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Hybrid Scholar Search

```bash
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/smart?query=machine+learning+optimization&max_num_results=10" \
  -H "Authorization: Bearer $AISA_API_KEY"
```

• Confidence: 90% confidence
• Finding: The hybrid scholar search request sends the user's query to a remote aggregation/search endpoint, extending the same external disclosure risk to combined retrieval workflows. Because hybrid search may broaden provider-side processing, the privacy impact may be greater than a simple local search would imply.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Sonar

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 92% confidence
• Finding: This endpoint sends user message content to an external Perplexity/Sonar API through AIsa using an authenticated bearer token. The transmission itself is expected for the feature, but it is still security-relevant because prompts may contain sensitive data and the skill does not present an explicit warning or restriction.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Sonar Pro

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar-pro" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 92% confidence
• Finding: The Sonar Pro example transmits richer user prompts to an external answer-generation service, potentially including proprietary analysis requests or embedded confidential context. This is normal functionality, but without disclosure or data minimization guidance it remains a real confidentiality risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Sonar Reasoning Pro

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar-reasoning-pro" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 92% confidence
• Finding: The Sonar Reasoning Pro flow sends analytical prompts to an external reasoning service, which may encourage users to submit strategic or sensitive business questions. That increases the chance of leaking confidential intent or internal decision-making context to a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Sonar Deep Research

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar-deep-research" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 93% confidence
• Finding: The deep research endpoint is especially sensitive because users may submit long, detailed prompts containing strategic plans, internal datasets, or proprietary analysis goals. Sending that content to an external provider without a prominent privacy warning materially raises confidentiality and governance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Tavily APIs

```bash
curl -X POST "https://api.aisa.one/apis/v1/tavily/search" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query":"latest AI developments"}'

• Confidence: 90% confidence
• Finding: The Tavily search example sends user queries to an external provider via AIsa, exposing search interests and possibly sensitive terms. This is expected behavior for remote search, but still requires disclosure and safe-use guidance.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Content-Type: application/json" \
  -d '{"query":"latest AI developments"}'

curl -X POST "https://api.aisa.one/apis/v1/tavily/extract" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"urls":["https://example.com/article"]}'

• Confidence: 94% confidence
• Finding: The extract endpoint sends arbitrary user-supplied URLs to an external service for retrieval and parsing. If users provide internal, private, signed, or otherwise sensitive URLs, this can disclose internal resources or trigger third-party access patterns that users did not intend.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Content-Type: application/json" \
  -d '{"urls":["https://example.com/article"]}'

curl -X POST "https://api.aisa.one/apis/v1/tavily/crawl" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com","max_depth":2}'

• Confidence: 95% confidence
• Finding: The crawl endpoint enables remote crawling of user-specified URLs, which can amplify risk beyond a single lookup by recursively accessing linked content. If pointed at internal or sensitive sites, this could expose site structure and content to third parties and create unintended scanning behavior.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Content-Type: application/json" \
  -d '{"url":"https://example.com","max_depth":2}'

curl -X POST "https://api.aisa.one/apis/v1/tavily/map" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

• Confidence: 94% confidence
• Finding: The site-map generation endpoint sends a target URL to an external service to enumerate site structure. For non-public or sensitive domains, this can disclose architecture and information layout to a third party, which is more sensitive than ordinary search.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.