Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent search helper that sends user-directed queries and URLs to AIsa-backed search APIs, with privacy cautions users should understand before use.
Install only if you are comfortable sending search queries, prompts, and supplied URLs to the AIsa-backed API using your AISA_API_KEY. Avoid submitting secrets, private documents, internal-only URLs, or proprietary research topics unless that external processing is approved.
The skill declares required environment variables and demonstrates networked execution, but it does not define an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and can cause the host agent to expose broader execution or network capabilities than users expect.
The documentation repeatedly instructs the agent to send user queries, system prompts, and supplied URLs to external services, but it provides no privacy, retention, or third-party processing warning. Users may unknowingly disclose sensitive prompts, internal URLs, or research targets to AIsa/Tavily/Perplexity-backed services.
The web search example transmits the user's query to a third-party API over the network. Although core to the skill's purpose, the absence of disclosure and guardrails makes accidental sharing of sensitive search terms a realistic risk.
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/web?query=AI+frameworks&max_num_results=10" \
-H "Authorization: Bearer $AISA_API_KEY"
The scholar search example sends user-supplied research queries to a remote API. In enterprise or confidential research settings, those terms can reveal internal strategy, investigations, or unpublished work.
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=transformer+models&max_num_results=10" \
-H "Authorization: Bearer $AISA_API_KEY"
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=LLM&max_num_results=10&as_ylo=2024&as_yhi=2025" \
This second scholar example includes the same external query transmission risk, with additional structured parameters that could further reveal the user's research intent. The risk is contextual but real because the skill presents the call as routine without any privacy warning.
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=transformer+models&max_num_results=10"
-H "Authorization: Bearer $AISA_API_KEY"
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=LLM&max_num_results=10&as_ylo=2024&as_yhi=2025"
-H "Authorization: Bearer $AISA_API_KEY"
The hybrid scholar search example transmits search intent to an external endpoint, which may aggregate or infer additional research context. That is normal for a search product, but still constitutes outward data flow that should be explicitly disclosed.
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/smart?query=machine+learning+optimization&max_num_results=10" \
-H "Authorization: Bearer $AISA_API_KEY"
This endpoint reference indicates off-platform transmission to AIsa-hosted Perplexity services. Because the payload includes free-form messages, it can expose sensitive instructions, proprietary questions, or internal context if used carelessly.
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{
This endpoint reference indicates off-platform transmission to AIsa-hosted Perplexity services. Because the payload includes free-form messages, it can expose sensitive instructions, proprietary questions, or internal context if used carelessly.
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{
Sonar Pro is designed for more complex queries and follow-ups, which increases the chance that users will send richer and more sensitive context to an external provider. The skill does not acknowledge that elevated disclosure risk.
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar-pro" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{
Reasoning-oriented prompts often contain strategic analysis, plans, or sensitive internal hypotheses; this example sends them externally. The danger is not hidden exfiltration code, but under-disclosed transmission of potentially sensitive content.
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar-reasoning-pro" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{
Deep research requests are especially likely to include broad internal objectives, market strategy, or sensitive investigative topics, all of which are sent off-platform. That makes this example more dangerous in context than a simple public web lookup.
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar-deep-research" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{
The Tavily search example sends search terms to an external API, creating the same confidentiality and privacy concerns as the other search calls. The skill omits any statement about third-party processing.
curl -X POST "https://api.aisa.one/apis/v1/tavily/search" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query":"latest AI developments"}'
The extract example sends arbitrary user-provided URLs to a third-party service, which can disclose internal endpoints, pre-release content locations, or sensitive document links. In some environments, merely revealing the existence of a URL is sensitive.
-H "Content-Type: application/json" \
-d '{"query":"latest AI developments"}'
curl -X POST "https://api.aisa.one/apis/v1/tavily/extract" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"urls":["https://example.com/article"]}'
The crawl example is more dangerous because it instructs a third-party service to recursively fetch a user-supplied URL. If misused with internal or semi-private targets, it could disclose site structure, linked resources, and sensitive locations to an external provider.
-H "Content-Type: application/json" \
-d '{"urls":["https://example.com/article"]}'
curl -X POST "https://api.aisa.one/apis/v1/tavily/crawl" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url":"https://example.com","max_depth":2}'
The map example sends a target URL to an external service for site mapping, which can reveal non-public site topology or strategic web assets. This is expected functionality, but risky without restrictions or disclosure.
-H "Content-Type: application/json" \
-d '{"url":"https://example.com","max_depth":2}'
curl -X POST "https://api.aisa.one/apis/v1/tavily/map" \
-H "Authorization: Bearer $AISA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url":"https://example.com"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class SearchClient:
"""OpenClaw Search API client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
self.api_key = api_key or os.environ.get("AISA_API_KEY")
The client sends user-supplied queries and URLs to third-party services, but the CLI does not provide an explicit disclosure or consent prompt. In an agent-skill context, users may unknowingly transmit sensitive prompts, internal URLs, or proprietary research targets to external providers, creating privacy and data-governance risk.
The manifest frames the skill as a search and retrieval tool over named sources. In addition to search, the code implements Tavily extract, crawl, and map operations, which expand the behavior from query-based retrieval into direct URL content extraction and website traversal/mapping.
No suspicious patterns detected.