Security audit

llama.cpp Provider

Security checks for vulnerabilities and agentic risk

Overview

This package is a coherent llama.cpp provider that installs or connects to local model servers with disclosed setup and verification steps.

Before installing, confirm you want OpenClaw to manage a local llama.cpp runtime and potentially download multi-GB models. Only enter an external llama-server API key for a server you trust, and review the disk, memory, and GPU requirements during setup.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/index.js:361
Evidence: execFile(command, args, {

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/index.js:2054
Evidence: const apiKey = [REDACTED]) ? await resolveLlamaServerRuntimeApiKey({ config: ctx.config }) : void 0;