OnDeckLLM

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:03 AM UTC
• Version: 1.4.3

Overview

This skill is purpose-aligned, but it asks users to globally install and run an unpinned third-party npm package that can read and modify local LLM provider configuration.

Review this before installing if you rely on OpenClaw provider settings. Prefer a pinned, audited OnDeckLLM version, avoid running the global install with elevated privileges, back up ~/.openclaw/openclaw.json before using the dashboard, and check what is stored under ~/.ondeckllm/ including usage.jsonl.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:10 and SKILL.md:18
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

yaml

install: npm install -g ondeckllm

The installation instruction is repeated in the prerequisites:

bash

npm install -g ondeckllm

Technical Analysis

The skill directs users or agents to install the latest available release of the external ondeckllm npm package without an exact version, lockfile, or integrity constraint. Consequently, the code installed at execution time may differ from the code that existed when this skill was reviewed.

npm packages can define lifecycle scripts that execute during installation with the permissions of the invoking user. The -g option installs the package globally, increasing its influence over the user's executable environment compared with a project-local installation. The external package source and its transitive dependencies are not included in this project, so their behavior could not be verified as part of this audit.

This finding does not establish that the named package is currently malicious. The vulnerability is the unsafe, mutable supply-chain trust model used by the installation instructions.

Attack Path

1. An attacker compromises the npm package, a maintainer account, or one of its transitive dependencies and publishes a malicious release.
2. A user or agent follows the skill instruction and runs npm install -g ondeckllm.
3. npm resolves the unpinned package name to the compromised current release.
4. Malicious package contents or lifecycle scripts execute with the invoking user's permissions.
5. The installed global executable can subsequently run attacker-controlled logic whenever ondeckllm is invoked.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user performing the installation. ...[truncated 485 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version, for example ondeckllm@X.Y.Z, rather than resolving the latest release.
2. Prefer a project-local dependency managed through package.json and a committed lockfile instead of a global installation.
3. Verify package integrity using an approved registry, lockfile integrity metadata, provenance attestations, or a documented package checksum.
4. Audit the selected package release and its transitive dependencies before recommending installation.
5. Disable npm lifecycle scripts with --ignore-scripts when they are not required; otherwise, explicitly document and review every required installation script.
6. Avoid administrator or root privileges and run the package under a least-privileged account.
7. Keep automated dependency monitoring in place and require review before updating the pinned version.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a full localhost dashboard for managing LLM providers, routing, and fallback chains. The supplied code does not implement a dashboard or any management features. It only performs a narrow status check: scans local processes for an ondeckllm process, probes http://localhost:3900/, and prints JSON with running state, port, URL, PID, and HTTP status. While this loosely relates to checking whether the dashboard is running, it is materially narrower than the declared purpose and includes local process inspection not mentioned in the description. Therefore the description does not accurately represent this code chunk's actual behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill states that dashboard changes sync back to ~/.openclaw/openclaw.json, but it does not prominently warn users that interacting with the UI can modify an existing agent/provider configuration file. This can lead to unintended configuration drift, service disruption, or accidental overwriting of provider settings and secrets-related references in a file the user may not expect to be changed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill omits a privacy/transparency warning that it auto-discovers provider settings from ~/.openclaw/openclaw.json and stores local usage data in ~/.ondeckllm/usage.jsonl. While this appears to be local-only behavior, users may not realize that provider metadata is being read automatically and that usage information is being retained on disk.

Content

No source excerpt is available for this finding.