Verified Research Engine (Web + Academic + Confidence Score)

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:26 PM UTC
• Version: 1.0.1

Overview

This is a disclosed search/API helper that sends user-provided searches, prompts, and URLs to AIsa-backed services; the main risk is privacy, not hidden or destructive behavior.

Install only if you are comfortable sending search terms, research prompts, and submitted URLs to AIsa-backed third-party APIs using your AISA_API_KEY. Avoid private/internal URLs, secrets, regulated data, or confidential business context in queries or Sonar prompts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The top-level description frames the skill as search/retrieval, but the documented behavior also includes URL extraction, crawling, site mapping, explanations, and a standalone CLI workflow. This mismatch can mislead users or agent orchestrators about the actual operational scope, increasing the chance of unintended data collection or broader network activity.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill requires environment access for an API key and performs network calls, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it easier for an agent runtime to invoke broader capabilities than a user may expect.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs sending user prompts, research queries, and arbitrary URLs to external APIs without an explicit warning that this content leaves the local environment. In an agent setting, users may unknowingly transmit sensitive prompts, internal URLs, or proprietary research targets to third-party services.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Web Search

```bash
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/web?query=AI+frameworks&max_num_results=10" \
  -H "Authorization: Bearer $AISA_API_KEY"
```

• Confidence: 84% confidence
• Finding: The web search example transmits search queries to an external service, which is a real privacy and data-governance concern when queries may include sensitive or proprietary terms. While expected for a search skill, the file does not provide any warning or limitation guidance.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Scholar Search

```bash
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=transformer+models&max_num_results=10" \
  -H "Authorization: Bearer $AISA_API_KEY"

curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=LLM&max_num_results=10&as_ylo=2024&as_yhi=2025" \

• Confidence: 84% confidence
• Finding: The scholar search example sends research queries to an external API, which can leak confidential interests, unpublished work topics, or internal project direction. This is a genuine external-transmission issue even though it is part of the intended functionality.

External Transmission

Medium

• Category: Data Exfiltration

Content

curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=transformer+models&max_num_results=10" \
  -H "Authorization: Bearer $AISA_API_KEY"

curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=LLM&max_num_results=10&as_ylo=2024&as_yhi=2025" \
  -H "Authorization: Bearer $AISA_API_KEY"
```

• Confidence: 84% confidence
• Finding: This variant of the scholar search still transmits user research queries externally, including topical and date-range information that may reveal strategic focus areas. The lack of explicit disclosure makes the transmission more risky in automated contexts.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Hybrid Scholar Search

```bash
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/smart?query=machine+learning+optimization&max_num_results=10" \
  -H "Authorization: Bearer $AISA_API_KEY"
```

• Confidence: 84% confidence
• Finding: The hybrid scholar search request sends user queries to a third-party endpoint, exposing potentially sensitive research topics outside the local environment. Because the skill is designed for retrieval, this is contextually expected but still requires transparency and controls.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Sonar

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 88% confidence
• Finding: This example sends user-supplied message content to an external Perplexity/AIsa endpoint, which creates a data exposure risk if prompts contain secrets, internal plans, or regulated data. The danger is amplified in autonomous-agent use because prompt contents may be assembled from prior context without the user realizing they are being transmitted.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Sonar

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 88% confidence
• Finding: This example sends user-supplied message content to an external Perplexity/AIsa endpoint, which creates a data exposure risk if prompts contain secrets, internal plans, or regulated data. The danger is amplified in autonomous-agent use because prompt contents may be assembled from prior context without the user realizing they are being transmitted.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Sonar Pro

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar-pro" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 88% confidence
• Finding: The Sonar Pro example submits structured user prompts to an external answer-generation endpoint, which may expose more detailed internal reasoning requests than a simple search query. In agent workflows, such prompts can inadvertently include aggregated context from private sources.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Sonar Reasoning Pro

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar-reasoning-pro" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 88% confidence
• Finding: The reasoning-oriented endpoint encourages submission of analytical prompts that may contain strategic or confidential business context to an external API. That creates a meaningful privacy and confidentiality risk if agents forward internal deliberations or proprietary questions.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Sonar Deep Research

```bash
curl -X POST "https://api.aisa.one/apis/v1/perplexity/sonar-deep-research" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 90% confidence
• Finding: The deep research endpoint is especially sensitive because it is intended for long-form, exhaustive research prompts that may include detailed internal objectives, competitor analyses, or strategic planning content. Sending such material to a third-party service can create disproportionate confidentiality exposure.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Tavily APIs

```bash
curl -X POST "https://api.aisa.one/apis/v1/tavily/search" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query":"latest AI developments"}'

• Confidence: 84% confidence
• Finding: The Tavily search example transmits user queries to an external service, which is a straightforward data-sharing risk. The context makes it expected behavior, but users still need notice and control.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Content-Type: application/json" \
  -d '{"query":"latest AI developments"}'

curl -X POST "https://api.aisa.one/apis/v1/tavily/extract" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"urls":["https://example.com/article"]}'

• Confidence: 90% confidence
• Finding: The extract endpoint sends arbitrary URLs to an external service for processing, which can disclose internal, unannounced, or access-sensitive targets if users supply private links. This is more dangerous than ordinary search because the submitted URLs themselves may be confidential.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Content-Type: application/json" \
  -d '{"urls":["https://example.com/article"]}'

curl -X POST "https://api.aisa.one/apis/v1/tavily/crawl" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com","max_depth":2}'

• Confidence: 92% confidence
• Finding: The crawl endpoint can cause external processing of a user-specified site and potentially broader traversal via depth settings, revealing interest in or structure of sensitive targets. If pointed at internal or pre-release sites, this could leak target information and increase unintended collection scope.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Content-Type: application/json" \
  -d '{"url":"https://example.com","max_depth":2}'

curl -X POST "https://api.aisa.one/apis/v1/tavily/map" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

• Confidence: 90% confidence
• Finding: The site-mapping endpoint sends a target URL to a third-party service for structural analysis, which can disclose internal reconnaissance targets or sensitive domains. In agent contexts, this expands beyond simple search into more active external analysis of user-designated sites.

External Transmission

Medium

• Category: Data Exfiltration

Content

class SearchClient:
    """OpenClaw Search API client."""

    BASE_URL = "https://api.aisa.one/apis/v1"

    def __init__(self, api_key: Optional[str] = None):
        self.api_key = api_key or os.environ.get("AISA_API_KEY")

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill metadata says it provides intelligent search, but the CLI also exposes arbitrary URL extraction, site crawling, and site mapping. That mismatch can cause downstream users or policy layers to authorize the skill for simple search while it can actually fetch and traverse user-supplied URLs, expanding data access and SSRF-like risk depending on the backend’s behavior.

Description-Behavior Mismatch

Low

• Confidence: 83% confidence
• Finding: The client includes an explain/summarization endpoint that is not reflected in the description. While less severe than hidden crawl capability, undisclosed transformation/summarization changes the trust boundary by allowing external content to be sent for model processing, which may affect data handling and user expectations.

Static analysis

No suspicious patterns detected.