Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward YouTube search API client, with expected third-party API use and no evidence of hidden persistence, privilege escalation, or destructive behavior.
Install only if you are comfortable sending YouTube research queries, locale/filter parameters, and your AISA_API_KEY to AIsa's API. Avoid using sensitive internal project names, regulated data, or secrets as search queries, and prefer a scoped API key if available.
The skill documents use of environment variables and outbound network access to a third-party API, but it does not declare tool scope such as permissions or allowed-tools. This weakens policy enforcement and user awareness, making it easier for an agent to access secrets and transmit data without explicit, reviewable capability boundaries.
The examples show search queries and a bearer token being sent to api.aisa.one, but the documentation does not clearly warn users that their prompts, research topics, and authentication data are transmitted to a third-party service. This creates a data handling and consent risk, especially if an agent forwards sensitive user queries or organizational research terms.
This example explicitly sends user-supplied search content and an authorization bearer token to an external service. While expected for an API client, it is still a real external transmission path that can expose sensitive research terms or credentials if the skill is used carelessly or without disclosure.
# Search for videos
curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=AI+agents+tutorial" \
-H "Authorization: Bearer $AISA_API_KEY"
This curl example sends a query and bearer token to api.aisa.one with regional targeting parameters. The added context parameters may reveal user geography or research market focus, increasing privacy sensitivity beyond a basic search request.
# Search in specific country (US)
curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=machine+learning&gl=us" \
-H "Authorization: Bearer $AISA_API_KEY"
# Search in Japan
This example transmits a query, locale settings, and a bearer token to an external API endpoint. The behavior is consistent with the skill's purpose, but it still creates a channel for third-party exposure of user intent, language preferences, and credentials.
-H "Authorization: Bearer $AISA_API_KEY"
curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=AI&gl=jp&hl=ja"
-H "Authorization: Bearer $AISA_API_KEY"
The sample request sends search content and an API key-derived bearer token to a third-party API. Even though this is normal API usage, it becomes dangerous if agents are allowed to forward sensitive prompts or if operators are unaware of the external transmission.
# Search with interface language
curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=python+tutorial&hl=en" \
-H "Authorization: Bearer $AISA_API_KEY"
# Chinese interface
This example sends a non-English query, locale parameters, and authentication data to api.aisa.one. The multilingual support does not change the core risk: user-supplied content and credentials are being disclosed externally without an adjacent warning in the documentation.
-H "Authorization: Bearer $AISA_API_KEY"
curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=编程教程&hl=zh-CN&gl=cn"
-H "Authorization: Bearer $AISA_API_KEY"
This request sends a query plus an opaque filter token to an external API using bearer authentication. Opaque pagination or filter tokens can encode user state or prior search context, so transmitting them externally may expose additional metadata beyond the visible query.
# Use sp parameter for pagination or advanced filters
curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=AI&sp=<filter_token>" \
-H "Authorization: Bearer $AISA_API_KEY"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
class YouTubeClient:
"""OpenClaw YouTube - YouTube SERP Scout API Client."""
BASE_URL = "https://api.aisa.one/apis/v1"
def __init__(self, api_key: Optional[str] = None):
"""Initialize the client with an API key."""
This code sends user-provided search terms, country, and language parameters to a remote service via urlopen, which is a network operation that transmits user data off-system. While the file is generally an API client, there is no explicit user-facing disclosure in the CLI flow or nearby comments that entered queries will be sent to api.aisa.one.
No suspicious patterns detected.