One API key for Chinese AI models. Route to Qwen, Deepseek

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:27 PM UTC
• Version: 1.0.1

Overview

This skill is a disclosed client for sending user prompts to AIsa's external Chinese LLM gateway, with no hidden persistence or local privilege behavior found.

Install only if you are comfortable sending prompts, code snippets, images by URL, and related metadata to AIsa and any downstream model providers it may use. Do not send secrets, regulated data, or proprietary code unless your organization has approved that provider and its retention terms.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The documentation claims broader provider coverage and an OpenAI-compatible gateway, while the described behavior is closer to a client wrapper for a specific remote service and includes undeclared comparison functionality. Security-relevant behavior mismatches reduce informed consent and can cause users to send prompts, credentials, or workload patterns under false assumptions about where data goes and what the skill does.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/cn_llm_client.py (reported line 250)May include surrounding context.

python

epilog="""
Examples:
    %(prog)s chat --model qwen-max --message "Hello!"
    %(prog)s chat --model deepseek-coder --message "Write a quicksort"
    %(prog)s chat --model deepseek-r1 --message "Which is larger, 9.9 or 9.11?"
    %(prog)s chat --model qwen-plus --message "Tell a story" --stream
    %(prog)s chat --model glm-4 --system "You are a poet" --message "Write a poem about spring"

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/cn_llm_client.py (reported line 251)May include surrounding context.

python

Examples:
    %(prog)s chat --model qwen-max --message "Hello!"
    %(prog)s chat --model deepseek-coder --message "Write a quicksort"
    %(prog)s chat --model deepseek-r1 --message "Which is larger, 9.9 or 9.11?"
    %(prog)s chat --model qwen-plus --message "Tell a story" --stream
    %(prog)s chat --model glm-4 --system "You are a poet" --message "Write a poem about spring"
    %(prog)s compare --models "qwen-max,deepseek-v3" --message "What is AI?"

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/cn_llm_client.py (reported line 253)May include surrounding context.

python

%(prog)s chat --model deepseek-coder --message "Write a quicksort"
    %(prog)s chat --model deepseek-r1 --message "Which is larger, 9.9 or 9.11?"
    %(prog)s chat --model qwen-plus --message "Tell a story" --stream
    %(prog)s chat --model glm-4 --system "You are a poet" --message "Write a poem about spring"
    %(prog)s compare --models "qwen-max,deepseek-v3" --message "What is AI?"
    %(prog)s models
        """

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The chat interface explicitly accepts arbitrary user messages and optional full JSON message arrays, then forwards them to the remote provider. In practice this can leak prior conversation context, system prompts, code, credentials, or other sensitive material that users may include, and the skill offers no sanitization, redaction, or warning at the input boundary.

Content

Scanner excerpt · scripts/cn_llm_client.py (reported line 262)May include surrounding context.

python

subparsers = parser.add_subparsers(dest="command", help="Commands")

    # Chat command
    chat_parser = subparsers.add_parser("chat", help="Send chat request")
    chat_parser.add_argument("--model", "-m", required=True, help="Model identifier")
    chat_parser.add_argument("--message", help="User message")
    chat_parser.add_argument("--messages", help="Full message array (JSON format)")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The README instructs users to send API requests and prompt data to an external service endpoint, which creates a real external-transmission risk surface. In this skill's context, that is the core function of the gateway, but it remains security-relevant because agent users may unknowingly exfiltrate sensitive prompts, code, or documents to a third-party processor.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

md

client = OpenAI(
    api_key=os.environ["AISA_API_KEY"],
    base_url="https://api.aisa.one/v1"
)

response = client.chat.completions.create(

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill requires environment access for AISA_API_KEY and performs network calls to a third-party API, but it does not declare any explicit tool scope such as permissions or allowed-tools. That weakens user visibility and policy enforcement around sensitive capabilities, making accidental secret exposure and unintended outbound requests more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs users to send prompts and an API bearer token to a remote LLM gateway, but it provides no privacy, retention, jurisdiction, or third-party processing warning. In a security context, users may unknowingly transmit confidential data, regulated content, or proprietary source code to an external processor.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The documented endpoint establishes that skill use depends on sending data to an external service boundary. Even without executable code in this file, that boundary is important because users may incorrectly assume purely local processing while prompts and associated metadata are actually transmitted off-platform.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

OpenAI Compatible Interface

text

POST https://api.aisa.one/v1/chat/completions

Qwen Example

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This occurrence reiterates use of the external AIsa API with bearer-token authentication and prompt transmission. The main danger is not the presence of HTTPS itself, but inadequate disclosure and guardrails around sending potentially sensitive data to a remote processor.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

Qwen Example

bash

curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This occurrence reiterates use of the external AIsa API with bearer-token authentication and prompt transmission. The main danger is not the presence of HTTPS itself, but inadequate disclosure and guardrails around sending potentially sensitive data to a remote processor.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

Qwen Example

bash

curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The DeepSeek example transmits prompts to the same external gateway, which may further route requests to downstream model providers. This expands the trust boundary and can expose proprietary or sensitive user data beyond the immediate API operator if not clearly documented.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

bash

# DeepSeek-V3 general chat (671B parameters)
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The reasoning-model example sends detailed natural-language problem content to a third-party endpoint and may encourage users to submit rich context or internal data for better answers. In enterprise settings, such examples can normalize external disclosure without adequate warning about retention, monitoring, or provider access.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

}'

# DeepSeek-R1 deep reasoning (supports Tools)
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This example again demonstrates authenticated external transmission to the AIsa API. Repeated outbound examples without adjacent security guidance make the skill context more dangerous because the skill’s entire purpose is to broker data to remote LLMs while normalizing that flow as routine.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md

}'

# DeepSeek-V3.1 Terminus latest version
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The code-generation example is especially sensitive because users commonly submit proprietary source code, architectural details, or credentials embedded in snippets to coding assistants. Sending such content to a third-party gateway without explicit warning materially raises confidentiality and IP leakage risk.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

Qwen3 Code Generation Example

bash

curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This repeated streaming endpoint reference confirms ongoing external transmission during streamed inference. In context, the skill is intended to proxy user content to remote Chinese LLM services, so the risk is real though expected: confidentiality depends entirely on proper disclosure, consent, and data-handling controls.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

Streaming Output

bash

curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This repeated streaming endpoint reference confirms ongoing external transmission during streamed inference. In context, the skill is intended to proxy user content to remote Chinese LLM services, so the risk is real though expected: confidentiality depends entirely on proper disclosure, consent, and data-handling controls.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

Streaming Output

bash

curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The client is hardwired to transmit all chat payloads to an external service endpoint, which creates a trust boundary crossing and potential data exposure path for any prompt content, system instructions, or embedded secrets. While external API use is expected for an LLM gateway client, it is still a real security concern when not paired with clear controls and disclosure.

Content

Scanner excerpt · scripts/cn_llm_client.py (reported line 31)May include surrounding context.

python

class CNLLMClient:
    """China LLM Unified Gateway Client."""

    BASE_URL = "https://api.aisa.one/v1"

    # Supported Chinese LLMs (from marketplace.aisa.one/pricing)
    SUPPORTED_MODELS = {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The CLI sends user-provided prompts and optional system messages to a third-party API, but it does not clearly warn users at the point of use that their content will leave the local environment. In a skill context, users may paste secrets, proprietary code, or sensitive business data into prompts, so lack of disclosure materially increases the risk of unintended data exfiltration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The README brands the skill as "OpenClaw CN-LLM" and "China LLM Unified Gateway," which presents a locale-specific positioning. There is no accompanying language or locale choice, opt-in, or justification explaining that the regional constraint is intentional and limited to a region-specific use case.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README demonstrates sending user-supplied prompts to a third-party endpoint via an OpenAI-compatible client but does not disclose that prompt contents and potentially sensitive inputs will leave the local environment. In an agent skill context, this omission can mislead users into transmitting proprietary, personal, or regulated data to an external service without informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The example sets the system message to "You are a professional Chinese assistant," which imposes a language/locale behavior in natural language. The skill documentation does not pair this with user opt-in, language selection guidance, or a clear statement that the constraint is optional and only for China-specific use cases.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.