AI/ML API LLM + Reasoning for OpenClaw

• Outcome: Pass
• Latest audit: May 28, 2026, 12:24 PM
• Version:
  1.0.1

Overview

This is a straightforward AIMLAPI chat helper that uses an API key, sends prompts to AIMLAPI, and can optionally save responses to a chosen file.

Install only if you intend to send prompts to AIMLAPI with your own API key. Prefer AIMLAPI_API_KEY over --apikey-file, use --output only for intended response files, avoid sending sensitive prompt content unless AIMLAPI handling is acceptable, and verify the publisher/version metadata before relying on it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises and demonstrates use of sensitive capabilities including environment-secret access (`AIMLAPI_API_KEY`), network calls to an external API, and file read/write via script arguments and outputs, but it does not declare corresponding permissions. That mismatch weakens policy enforcement and review, making it easier for an agent to invoke external communication or handle local data in ways operators did not explicitly approve.

VirusTotal

65/65 vendors flagged this skill as clean.