One API key for Chinese AI models. Route to Qwen, Deepseek

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:27 PM UTC
• Version: 1.0.1

Overview

This skill is a disclosed client for sending user prompts to AIsa's external Chinese LLM gateway, with no hidden persistence or local privilege behavior found.

Install only if you are comfortable sending prompts, code snippets, images by URL, and related metadata to AIsa and any downstream model providers it may use. Do not send secrets, regulated data, or proprietary code unless your organization has approved that provider and its retention terms.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documentation claims broader provider coverage and an OpenAI-compatible gateway, while the described behavior is closer to a client wrapper for a specific remote service and includes undeclared comparison functionality. Security-relevant behavior mismatches reduce informed consent and can cause users to send prompts, credentials, or workload patterns under false assumptions about where data goes and what the skill does.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

epilog="""
Examples:
    %(prog)s chat --model qwen-max --message "Hello!"
    %(prog)s chat --model deepseek-coder --message "Write a quicksort"
    %(prog)s chat --model deepseek-r1 --message "Which is larger, 9.9 or 9.11?"
    %(prog)s chat --model qwen-plus --message "Tell a story" --stream
    %(prog)s chat --model glm-4 --system "You are a poet" --message "Write a poem about spring"

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

Examples:
    %(prog)s chat --model qwen-max --message "Hello!"
    %(prog)s chat --model deepseek-coder --message "Write a quicksort"
    %(prog)s chat --model deepseek-r1 --message "Which is larger, 9.9 or 9.11?"
    %(prog)s chat --model qwen-plus --message "Tell a story" --stream
    %(prog)s chat --model glm-4 --system "You are a poet" --message "Write a poem about spring"
    %(prog)s compare --models "qwen-max,deepseek-v3" --message "What is AI?"

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

%(prog)s chat --model deepseek-coder --message "Write a quicksort"
    %(prog)s chat --model deepseek-r1 --message "Which is larger, 9.9 or 9.11?"
    %(prog)s chat --model qwen-plus --message "Tell a story" --stream
    %(prog)s chat --model glm-4 --system "You are a poet" --message "Write a poem about spring"
    %(prog)s compare --models "qwen-max,deepseek-v3" --message "What is AI?"
    %(prog)s models
        """

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Context Leakage

High

• Category: Data Exfiltration

Content

subparsers = parser.add_subparsers(dest="command", help="Commands")

    # Chat command
    chat_parser = subparsers.add_parser("chat", help="Send chat request")
    chat_parser.add_argument("--model", "-m", required=True, help="Model identifier")
    chat_parser.add_argument("--message", help="User message")
    chat_parser.add_argument("--messages", help="Full message array (JSON format)")

• Confidence: 90% confidence
• Finding: The chat interface explicitly accepts arbitrary user messages and optional full JSON message arrays, then forwards them to the remote provider. In practice this can leak prior conversation context, system prompts, code, credentials, or other sensitive material that users may include, and the skill offers no sanitization, redaction, or warning at the input boundary.

External Transmission

Medium

• Category: Data Exfiltration

Content

client = OpenAI(
    api_key=os.environ["AISA_API_KEY"],
    base_url="https://api.aisa.one/v1"
)

response = client.chat.completions.create(

• Confidence: 97% confidence
• Finding: The README instructs users to send API requests and prompt data to an external service endpoint, which creates a real external-transmission risk surface. In this skill's context, that is the core function of the gateway, but it remains security-relevant because agent users may unknowingly exfiltrate sensitive prompts, code, or documents to a third-party processor.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill requires environment access for `AISA_API_KEY` and performs network calls to a third-party API, but it does not declare any explicit tool scope such as `permissions` or `allowed-tools`. That weakens user visibility and policy enforcement around sensitive capabilities, making accidental secret exposure and unintended outbound requests more likely.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs users to send prompts and an API bearer token to a remote LLM gateway, but it provides no privacy, retention, jurisdiction, or third-party processing warning. In a security context, users may unknowingly transmit confidential data, regulated content, or proprietary source code to an external processor.

External Transmission

Medium

• Category: Data Exfiltration

Content

### OpenAI Compatible Interface

```
POST https://api.aisa.one/v1/chat/completions
```

#### Qwen Example

• Confidence: 90% confidence
• Finding: The documented endpoint establishes that skill use depends on sending data to an external service boundary. Even without executable code in this file, that boundary is important because users may incorrectly assume purely local processing while prompts and associated metadata are actually transmitted off-platform.

External Transmission

Medium

• Category: Data Exfiltration

Content

#### Qwen Example

```bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 93% confidence
• Finding: This occurrence reiterates use of the external AIsa API with bearer-token authentication and prompt transmission. The main danger is not the presence of HTTPS itself, but inadequate disclosure and guardrails around sending potentially sensitive data to a remote processor.

External Transmission

Medium

• Category: Data Exfiltration

Content

#### Qwen Example

```bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 93% confidence
• Finding: This occurrence reiterates use of the external AIsa API with bearer-token authentication and prompt transmission. The main danger is not the presence of HTTPS itself, but inadequate disclosure and guardrails around sending potentially sensitive data to a remote processor.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# DeepSeek-V3 general chat (671B parameters)
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 93% confidence
• Finding: The DeepSeek example transmits prompts to the same external gateway, which may further route requests to downstream model providers. This expands the trust boundary and can expose proprietary or sensitive user data beyond the immediate API operator if not clearly documented.

External Transmission

Medium

• Category: Data Exfiltration

Content

}'

# DeepSeek-R1 deep reasoning (supports Tools)
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 94% confidence
• Finding: The reasoning-model example sends detailed natural-language problem content to a third-party endpoint and may encourage users to submit rich context or internal data for better answers. In enterprise settings, such examples can normalize external disclosure without adequate warning about retention, monitoring, or provider access.

External Transmission

Medium

• Category: Data Exfiltration

Content

}'

# DeepSeek-V3.1 Terminus latest version
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 93% confidence
• Finding: This example again demonstrates authenticated external transmission to the AIsa API. Repeated outbound examples without adjacent security guidance make the skill context more dangerous because the skill’s entire purpose is to broker data to remote LLMs while normalizing that flow as routine.

External Transmission

Medium

• Category: Data Exfiltration

Content

#### Qwen3 Code Generation Example

```bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 94% confidence
• Finding: The code-generation example is especially sensitive because users commonly submit proprietary source code, architectural details, or credentials embedded in snippets to coding assistants. Sending such content to a third-party gateway without explicit warning materially raises confidentiality and IP leakage risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Streaming Output

```bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 92% confidence
• Finding: This repeated streaming endpoint reference confirms ongoing external transmission during streamed inference. In context, the skill is intended to proxy user content to remote Chinese LLM services, so the risk is real though expected: confidentiality depends entirely on proper disclosure, consent, and data-handling controls.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Streaming Output

```bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 92% confidence
• Finding: This repeated streaming endpoint reference confirms ongoing external transmission during streamed inference. In context, the skill is intended to proxy user content to remote Chinese LLM services, so the risk is real though expected: confidentiality depends entirely on proper disclosure, consent, and data-handling controls.

External Transmission

Medium

• Category: Data Exfiltration

Content

class CNLLMClient:
    """China LLM Unified Gateway Client."""

    BASE_URL = "https://api.aisa.one/v1"

    # Supported Chinese LLMs (from marketplace.aisa.one/pricing)
    SUPPORTED_MODELS = {

• Confidence: 88% confidence
• Finding: The client is hardwired to transmit all chat payloads to an external service endpoint, which creates a trust boundary crossing and potential data exposure path for any prompt content, system instructions, or embedded secrets. While external API use is expected for an LLM gateway client, it is still a real security concern when not paired with clear controls and disclosure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The CLI sends user-provided prompts and optional system messages to a third-party API, but it does not clearly warn users at the point of use that their content will leave the local environment. In a skill context, users may paste secrets, proprietary code, or sensitive business data into prompts, so lack of disclosure materially increases the risk of unintended data exfiltration.

Natural-Language Policy Violations

Low

• Confidence: 71% confidence
• Finding: The README brands the skill as "OpenClaw CN-LLM" and "China LLM Unified Gateway," which presents a locale-specific positioning. There is no accompanying language or locale choice, opt-in, or justification explaining that the regional constraint is intentional and limited to a region-specific use case.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: The README demonstrates sending user-supplied prompts to a third-party endpoint via an OpenAI-compatible client but does not disclose that prompt contents and potentially sensitive inputs will leave the local environment. In an agent skill context, this omission can mislead users into transmitting proprietary, personal, or regulated data to an external service without informed consent.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The example sets the system message to "You are a professional Chinese assistant," which imposes a language/locale behavior in natural language. The skill documentation does not pair this with user opt-in, language selection guidance, or a clear statement that the constraint is optional and only for China-specific use cases.

Static analysis

No suspicious patterns detected.