ClawHub
Back to skill

Security audit

One API key. 70+ models. Route requests to GPT, Claude, Gemini, Qwen, Deepseek, Grok and more.

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward client for sending user-selected LLM requests to the AISA API, with no hidden persistence or local system control found.

Install only if you intend to route prompts, system messages, image URLs or image data, and function schemas through AISA's hosted API using your AISA_API_KEY. Avoid sending secrets, regulated data, private internal URLs, or confidential images unless your organization has approved that provider and billing model.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (21)

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/llm_router_client.py (reported line 255)May include surrounding context.

python
formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog="""
Examples:
    %(prog)s chat --model gpt-4.1 --message "Hello!"
    %(prog)s chat --model claude-3-sonnet --message "Write a poem" --stream
    %(prog)s chat --model gpt-4 --system "You are a pirate" --message "Greet me"
    %(prog)s vision --model gpt-4o --image "https://example.com/img.jpg" --prompt "Describe this"

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/llm_router_client.py (reported line 256)May include surrounding context.

python
epilog="""
Examples:
    %(prog)s chat --model gpt-4.1 --message "Hello!"
    %(prog)s chat --model claude-3-sonnet --message "Write a poem" --stream
    %(prog)s chat --model gpt-4 --system "You are a pirate" --message "Greet me"
    %(prog)s vision --model gpt-4o --image "https://example.com/img.jpg" --prompt "Describe this"
    %(prog)s compare --models "gpt-4.1,claude-3-sonnet" --message "Explain AI"

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/llm_router_client.py (reported line 257)May include surrounding context.

python
Examples:
    %(prog)s chat --model gpt-4.1 --message "Hello!"
    %(prog)s chat --model claude-3-sonnet --message "Write a poem" --stream
    %(prog)s chat --model gpt-4 --system "You are a pirate" --message "Greet me"
    %(prog)s vision --model gpt-4o --image "https://example.com/img.jpg" --prompt "Describe this"
    %(prog)s compare --models "gpt-4.1,claude-3-sonnet" --message "Explain AI"
    %(prog)s models

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/llm_router_client.py (reported line 258)May include surrounding context.

python
%(prog)s chat --model gpt-4.1 --message "Hello!"
    %(prog)s chat --model claude-3-sonnet --message "Write a poem" --stream
    %(prog)s chat --model gpt-4 --system "You are a pirate" --message "Greet me"
    %(prog)s vision --model gpt-4o --image "https://example.com/img.jpg" --prompt "Describe this"
    %(prog)s compare --models "gpt-4.1,claude-3-sonnet" --message "Explain AI"
    %(prog)s models
        """

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README encourages sending chat prompts and image URLs to the vendor-hosted API without clearly warning that user inputs and referenced resources are transmitted to a third-party service. In an agent context, operators may assume a local or first-party routing layer and unknowingly expose sensitive prompts, proprietary data, or internal image references to an external provider.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares required environment variables and demonstrates network access to a third-party API, but it does not declare an explicit tool scope such as permissions or allowed-tools. This increases the risk that an agent framework may grant broader-than-necessary capabilities or execute the skill without clear operator consent about network and secret access.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Declaring the external endpoint itself is not malicious, but it confirms that the skill depends on outbound network transmission to a third-party service. In agent environments, that capability can expose user data and internal context beyond the local trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

OpenAI-Compatible Chat Completions

text
POST https://api.aisa.one/v1/chat/completions

Request

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This authenticated request sends chat payloads to api.aisa.one using the provided API key. The main danger is not code execution but silent transfer of potentially sensitive prompts and credentials-backed usage to a third-party processor.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

Request

bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This authenticated request sends chat payloads to api.aisa.one using the provided API key. The main danger is not code execution but silent transfer of potentially sensitive prompts and credentials-backed usage to a third-party processor.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

Request

bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This section explicitly instructs sending conversation messages and optional multimodal content to a third-party endpoint, but it provides no privacy or data-sharing warning. In an agent setting, users may unknowingly transmit sensitive prompts, internal context, or images to an external service, creating confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The external streaming endpoint again indicates third-party transmission of prompt data under bearer-token authentication. If used by an autonomous agent, the streamed interaction may leak internal reasoning context or user data to an external provider and into observability systems.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

Streaming Response

bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The external streaming endpoint again indicates third-party transmission of prompt data under bearer-token authentication. If used by an autonomous agent, the streamed interaction may leak internal reasoning context or user data to an external provider and into observability systems.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

Streaming Response

bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The vision example sends image URLs or base64 image data to a third-party API without adjacent privacy guidance. Images can contain highly sensitive personal, proprietary, or location information, so transmitting them externally raises a higher confidentiality and compliance risk than plain text prompts.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

Analyze images by passing image URLs or base64 data:

bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The function-calling example still sends user prompts and tool schemas to an external API. Tool definitions can reveal internal system capabilities or data structures, which may expand information disclosure beyond the prompt itself.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

Enable tools/functions for structured outputs:

bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This endpoint declaration for Gemini-native format indicates another external transmission path to the same third-party gateway. Multiple protocol paths broaden the ways sensitive content may leave the environment if operators are not clearly informed.

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

For Gemini models, you can also use the native format:

text
POST https://api.aisa.one/v1/models/{model}:generateContent
bash

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The Gemini native request example performs the same kind of third-party transmission under bearer-token authentication. Even though this is ordinary API usage, it remains a real data exposure concern in a skill context because prompts are routed outside the local environment.

Content

Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.

text

```bash
curl -X POST "https://api.aisa.one/v1/models/gemini-2.0-flash:generateContent" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The OpenAI SDK compatibility example configures a client to send requests to the external AISA endpoint, potentially making third-party routing less visible to users who assume standard OpenAI handling. That abstraction can reduce transparency about where data and credentials are actually going.

Content

Scanner excerpt · SKILL.md (reported line 434)May include surrounding context.

md
client = OpenAI(
    api_key=os.environ["AISA_API_KEY"],
    base_url="https://api.aisa.one/v1"
)

response = client.chat.completions.create(

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

md
class LLMRouterClient:
    """Unified LLM Gateway Client for AIsa API."""
    
    BASE_URL = "https://api.aisa.one/v1"
    
    # Popular models for reference (check marketplace.aisa.one/pricing for full list)
    SUPPORTED_MODELS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/llm_router_client.py (reported line 26)May include surrounding context.

python
class LLMRouterClient:
    """Unified LLM Gateway Client for AIsa API."""
    
    BASE_URL = "https://api.aisa.one/v1"
    
    # Popular models for reference (check marketplace.aisa.one/pricing for full list)
    SUPPORTED_MODELS = {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The CLI accepts prompts and image URLs and sends them to a third-party API, but it does not present an explicit warning or consent prompt at the point of transmission. In a security-sensitive agent skill, this can lead users to unknowingly disclose secrets, proprietary text, or internal image references to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill tells users to export an API key into an environment variable but does not warn about secure credential handling. While common practice, omitting basic guidance can lead to keys being exposed in shell history, logs, screenshots, or shared environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.