Back to plugin

Security audit

LLM Bench

Security checks for vulnerabilities and agentic risk

Overview

The plugin's code, declared behavior, and runtime instructions are coherent with its stated purpose (benchmark LLMs); nothing in the package requires unrelated credentials or surprising system access.

This plugin appears to do what it says: run prompts against configured LLM providers, score the outputs, and save reports to disk. Before installing, consider: 1) Confirm where results will be stored (default ~/.openclaw/bench-results) and whether you’re comfortable with those files being created. 2) The plugin uses whatever LLM providers your OpenClaw runtime is already configured with — benchmarking will consume API calls and may incur cost on those accounts. 3) The repo includes a package-lock.json with many third‑party SDKs; you do not need to run npm install unless you plan to develop locally — if you do, review package-lock.json and package.json first. 4) If you need extra assurance, scan storage.js and custom-suites.js (they perform the file I/O) and verify you are comfortable with the file operations. Overall the package is internally consistent and proportionate to its stated goal.

Static analysis

No suspicious patterns detected.