Security audit

OpenClaw Multi-LLM Adapter

Security checks across malware telemetry and agentic risk

Overview

This is a normal multi-LLM connector, but users should treat prompts, tool schemas, and provider API keys as sensitive.

Install only if you are comfortable sending prompts, system messages, and tool definitions to the LLM providers you configure. Use dedicated API keys, avoid secrets in prompts, avoid auto/compare modes for sensitive data, and pin dependencies before production or regulated use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Automatic fallback and load balancing can cause the same prompt to be transmitted to alternate providers without the user's explicit awareness. That makes this skill more dangerous than a single-provider adapter because a failure or retry path may broaden data exposure across vendors and jurisdictions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Automatic fallback and load balancing can cause the same prompt to be transmitted to alternate providers without the user's explicit awareness. That makes this skill more dangerous than a single-provider adapter because a failure or retry path may broaden data exposure across vendors and jurisdictions.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation advertises tool execution (`--execute-tools`) without warning that tools may modify files, call external services, or otherwise change system state. In an LLM-integrated workflow, tool execution can turn model output into real side effects, increasing the risk of prompt-influenced actions on user data or connected systems.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The chat path sends user messages and optional tool definitions to external LLM providers without any explicit disclosure or confirmation at the point of transmission. In a multi-provider adapter, this creates a real privacy and data-handling risk because users may unknowingly transmit sensitive prompts or tool schemas to third parties.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The compare command forwards the same user message to multiple external providers, which expands the disclosure surface beyond a single vendor. This increases confidentiality and compliance risk if users believe they are testing locally or with only one provider.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Multi-LLM Adapter Dependencies # OpenAI openai>=1.0.0 # Anthropic anthropic>=0.18.0
Confidence: 91% confidence
Finding: openai>=1.0.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: openai>=1.0.0 # Anthropic anthropic>=0.18.0 # HTTP requests (for Ollama) requests>=2.28.0
Confidence: 95% confidence
Finding: anthropic>=0.18.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: anthropic>=0.18.0 # HTTP requests (for Ollama) requests>=2.28.0 # Optional: Google Gemini # google-generativeai>=0.3.0
Confidence: 97% confidence
Finding: requests>=2.28.0

Known Vulnerable Dependency: anthropic — 2 advisory(ies): CVE-2026-34450 (Claude SDK for Python has Insecure Default File Permissions in Local Filesystem ); CVE-2026-34452 (Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox)

Low

Category: Supply Chain
Confidence: 73% confidence
Finding: anthropic

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 96% confidence
Finding: requests

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.