LiteLLM

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:09 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward LiteLLM helper, but users should understand that prompts and API keys are used with external LLM providers or proxies.

Install this only in an environment where you are comfortable sending prompt contents to the configured LLM provider or LiteLLM proxy. Avoid pasting secrets or regulated data unless that provider and proxy are approved, and consider pinning LiteLLM in a dedicated virtual environment before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:77

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 77-82
Vulnerability Type: Unpinned and unverifiable third-party dependency
Risk Level: Medium

Vulnerable Code

bash

pip install litellm

# Set provider keys (or configure in proxy)
export OPENAI_API_KEY="sk-..."
export ANTHROPIC_API_KEY="sk-..."

Technical Analysis

The setup instructions install litellm without specifying a reviewed version, cryptographic hashes, a lockfile, or a trusted package index. Consequently, the resolved package is mutable and may differ between installations.

Python package installation can execute package-controlled build or installation logic. After installation, the helper imports and executes the dependency in scripts/llm_call.py. Because LiteLLM processes prompts, proxy configuration, and provider credentials, a compromised or malicious release could intercept this sensitive information or execute arbitrary code under the installing user's account.

This is a supply-chain weakness rather than evidence that the current LiteLLM package is malicious.

Attack Path

1. An attacker compromises the upstream package, a maintainer account, or the package distribution channel.
2. The attacker publishes a malicious release that satisfies the unrestricted pip install litellm instruction.
3. A user follows the documented setup instructions and retrieves the mutable latest release.
4. Malicious code executes during package installation, import, or a subsequent litellm.completion() call.
5. The malicious dependency can access data and capabilities available to the process, potentially including LLM prompts, API credentials, proxy credentials, files readable by the user, and outbound network access.

Impact Assessment

Successful exploitation would execute code with the privileges of the user performing the installation or running the helper. The affected scope may include:

• Exposure of OpenAI, Anthropic, or LiteLLM proxy credentials availabl ...[truncated 394 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin LiteLLM to a specifically reviewed version rather than resolving the latest release:

   text

   litellm==<reviewed-version>
   

2. Maintain dependencies in a version-controlled lockfile or requirements file containing cryptographic hashes.
3. Install with hash verification enabled:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Generate hashes only from reviewed artifacts obtained through a trusted package index.
5. Document the expected package index and prevent fallback to untrusted or unintended repositories.
6. Recommend installation in a dedicated virtual environment with minimal filesystem and credential access.
7. Periodically review and deliberately update the pinned version after checking release provenance, security advisories, and dependency changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill demonstrates use of environment-backed secrets and external API access but does not declare any tool scope or permissions boundaries. In agent environments, missing scope declarations can cause overbroad execution assumptions and make it harder for users or orchestrators to understand that the skill may read API keys from the environment and transmit data to third-party services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly encourages sending prompts to external LLM providers, including through a proxy, but provides no warning that user content may leave the local environment and be processed by third parties. This creates a real data exposure risk because users may paste secrets, source code, internal documents, or regulated data into prompts without informed consent or provider-specific privacy review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This script sends the provided prompt and optional system message directly to a third-party LLM provider or LiteLLM proxy, but it does not provide any runtime warning, consent mechanism, or sensitivity check before transmission. In a CLI helper intended for ad hoc prompting, users may paste secrets, proprietary code, or personal data without realizing it will leave the local environment and may be logged or retained by the upstream provider or proxy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.