Security audit
LLM Bench
Security checks for vulnerabilities and agentic risk
Overview
The plugin's code, declared behavior, and runtime instructions are coherent with its stated purpose (benchmark LLMs); nothing in the package requires unrelated credentials or surprising system access.
This plugin appears to do what it says: run prompts against configured LLM providers, score the outputs, and save reports to disk. Before installing, consider: 1) Confirm where results will be stored (default ~/.openclaw/bench-results) and whether you’re comfortable with those files being created. 2) The plugin uses whatever LLM providers your OpenClaw runtime is already configured with — benchmarking will consume API calls and may incur cost on those accounts. 3) The repo includes a package-lock.json with many third‑party SDKs; you do not need to run npm install unless you plan to develop locally — if you do, review package-lock.json and package.json first. 4) If you need extra assurance, scan storage.js and custom-suites.js (they perform the file I/O) and verify you are comfortable with the file operations. Overall the package is internally consistent and proportionate to its stated goal.
Static analysis
No suspicious patterns detected.
