Security audit

Oracle GenAI

Security checks across malware telemetry and agentic risk

Overview

This package coherently adds an Oracle OCI model provider and its sensitive access is disclosed and limited to Oracle provider authentication and model/chat calls.

Install only if you intend OpenClaw to use your Oracle OCI tenancy. The plugin will need access to your OCI config file and the private key or token referenced by that config so it can sign Oracle API requests, and prompts/model requests will be sent to Oracle OCI under your account.

VirusTotal

60/60 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.env_credential_access, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: dist/index.js:114226
Evidence: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);

Python code POSTs credential environment variables to an environment-controlled URL.

Critical

Code: suspicious.env_credential_access
Location: dist/index.js:16074
Evidence: return this._client.post("/v1/files", multipartFormRequestOptions({

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/index.js:50
Evidence: const gacPath = process.env.GOOGLE_APPLICATION_CREDENTIALS;

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/index.js:42115
Evidence: * { authorization: '[REDACTED]' }