Security audit

Omnicall AI Gateway — 248 LLMs, keyless, OpenClaw default

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real paid AI gateway, but its setup can route all model requests through it and automatically spend wallet funds without clearly documented limits.

Review carefully before installing. Use a pinned package version where possible, avoid making it the default model route unless you intend all model traffic to pass through Omnicall, and only connect a wallet with strict spending limits or funds you are prepared to spend. Do not route secrets, private code, personal data, or regulated information through the service unless you have reviewed its privacy, retention, downstream-provider, and payment controls.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:20
Finding: Unpinned Third-Party Packages May Execute Unreviewed Code
Content: View full analysis
Remediation: View remediation
setup` - `npx omnicall-mcp@` - `pip install omnicall==` 2. Provide package-lock files, requirements lockfiles, or cryptographic hashes for reproducible installation. 3. Use hash verification for Python packages and npm lockfile integrity metadata where supported. 4. Recommend installing the package without running it first, then reviewing its metadata, lifecycle scripts, entry points, and dependency tree. 5. Avoid `npx` for security-sensitive setup unless the exact package version and integrity are verified. 6. Document the trusted package registry and verified publisher identity. 7. Disable or explicitly review npm lifecycle scripts during installation when operationally possible. ]]>

T07 · Tool Hijacking and Spoofing

Warning

Location: SKILL.md:20
Finding: Setup Replaces the Default Model Route and Enables Automatic Wallet Payments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill describes automatic payment behavior via an OpenClaw wallet that 'auto-pays the HTTP 402 and retries' but does not present this as a prominent warning before installation or use. This is dangerous because users or agents may unintentionally authorize billable requests, especially once the router is made the default path for all model traffic, creating a direct financial risk and potentially repeated automated charges.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The top-level description markets the skill as the solution for virtually any AI or live-data need, which encourages overbroad activation without evaluating whether the task actually requires this external paid gateway. In practice, that increases the chance an agent routes sensitive prompts, research queries, or unnecessary traffic to a third party and may trigger charges or data exposure in situations where a narrower tool would suffice.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The 'When to use this' section uses broad catch-all criteria like needing 'any LLM' or live data/tools, with no scope limits, trust boundaries, or sensitivity guidance. In an autonomous or semi-autonomous agent environment, this can cause the skill to be selected too often, sending user data to a remote service and invoking paid capabilities without clear necessity or informed approval.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The skill instructs users to execute npx omnicall-router setup without pinning a package version, which means code is fetched and run from the registry at install time with whatever version is current then. Because this command is also promoted as becoming the default gateway and routing every request, a compromised or malicious package update could immediately intercept prompts, tool traffic, wallet-related payment flows, or alter agent behavior at scale.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The router command is again presented unpinned in the npm section, duplicating the same supply-chain risk of executing whatever code the registry serves at the time of use. Since a router can sit in the path of all model traffic, compromise here can have outsized confidentiality and integrity impact compared with an ordinary utility package.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The router command is again presented unpinned in the npm section, duplicating the same supply-chain risk of executing whatever code the registry serves at the time of use. Since a router can sit in the path of all model traffic, compromise here can have outsized confidentiality and integrity impact compared with an ordinary utility package.
Content: No source excerpt is available for this finding.