go-llama-api

• Outcome: Pass
• Latest audit: Oct 17, 2026 · 4:03 AM UTC
• Version: 0.1.1

Overview

This skill is a straightforward Go client reference for Meta's Llama API, with disclosed API-key and network use.

Install only if you intend to use this unofficial Go package with Meta's Llama API. Treat LLAMA_API_KEY as a secret, review the upstream module before adding it to a project, and only send prompts or upload files that you are comfortable sharing with Meta.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: go-llama-api
description: Unofficial Go client for the Meta Llama API, generated from Meta's OpenAPI spec. `llama.NewClientWithResponses("https://api.llama.com/v1", auth)` from `github.com/psyb0t/go-llama-api` gives typed methods for chat completions (`CreateChatCompletionWithResponse`), models (`ListModelsWithResponse`, `RetrieveModelWithResponse`), moderations (`ModerationsWithResponse`) and file uploads (`PostUploadsWithResponse`, `GetUploadsUploadIdWithResponse`, `PostUploadsUploadIdWithResponse`), with responses decoded into `JSON200` and error structs. Auth is a Bearer API key set through a `RequestEditorFn`. Use when Go code needs to call the Llama API or already imports go-llama-api.
homepage: https://github.com/psyb0t/go-llama-api
user-invocable: true
metadata:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

---
name: go-llama-api
description: Unofficial Go client for the Meta Llama API, generated from Meta's OpenAPI spec. `llama.NewClientWithResponses("https://api.llama.com/v1", auth)` from `github.com/psyb0t/go-llama-api` gives typed methods for chat completions (`CreateChatCompletionWithResponse`), models (`ListModelsWithResponse`, `RetrieveModelWithResponse`), moderations (`ModerationsWithResponse`) and file uploads (`PostUploadsWithResponse`, `GetUploadsUploadIdWithResponse`, `PostUploadsUploadIdWithResponse`), with responses decoded into `JSON200` and error structs. Auth is a Bearer API key set through a `RequestEditorFn`. Use when Go code needs to call the Llama API or already imports go-llama-api.
homepage: https://github.com/psyb0t/go-llama-api
user-invocable: true
metadata:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

---
name: go-llama-api
description: Unofficial Go client for the Meta Llama API, generated from Meta's OpenAPI spec. `llama.NewClientWithResponses("https://api.llama.com/v1", auth)` from `github.com/psyb0t/go-llama-api` gives typed methods for chat completions (`CreateChatCompletionWithResponse`), models (`ListModelsWithResponse`, `RetrieveModelWithResponse`), moderations (`ModerationsWithResponse`) and file uploads (`PostUploadsWithResponse`, `GetUploadsUploadIdWithResponse`, `PostUploadsUploadIdWithResponse`), with responses decoded into `JSON200` and error structs. Auth is a Bearer API key set through a `RequestEditorFn`. Use when Go code needs to call the Llama API or already imports go-llama-api.
homepage: https://github.com/psyb0t/go-llama-api
user-invocable: true
metadata:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

---
name: go-llama-api
description: Unofficial Go client for the Meta Llama API, generated from Meta's OpenAPI spec. `llama.NewClientWithResponses("https://api.llama.com/v1", auth)` from `github.com/psyb0t/go-llama-api` gives typed methods for chat completions (`CreateChatCompletionWithResponse`), models (`ListModelsWithResponse`, `RetrieveModelWithResponse`), moderations (`ModerationsWithResponse`) and file uploads (`PostUploadsWithResponse`, `GetUploadsUploadIdWithResponse`, `PostUploadsUploadIdWithResponse`), with responses decoded into `JSON200` and error structs. Auth is a Bearer API key set through a `RequestEditorFn`. Use when Go code needs to call the Llama API or already imports go-llama-api.
homepage: https://github.com/psyb0t/go-llama-api
user-invocable: true
metadata:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/setup.md (reported line 24)May include surrounding context.

md

---
name: go-llama-api
description: Unofficial Go client for the Meta Llama API, generated from Meta's OpenAPI spec. `llama.NewClientWithResponses("https://api.llama.com/v1", auth)` from `github.com/psyb0t/go-llama-api` gives typed methods for chat completions (`CreateChatCompletionWithResponse`), models (`ListModelsWithResponse`, `RetrieveModelWithResponse`), moderations (`ModerationsWithResponse`) and file uploads (`PostUploadsWithResponse`, `GetUploadsUploadIdWithResponse`, `PostUploadsUploadIdWithResponse`), with responses decoded into `JSON200` and error structs. Auth is a Bearer API key set through a `RequestEditorFn`. Use when Go code needs to call the Llama API or already imports go-llama-api.
homepage: https://github.com/psyb0t/go-llama-api
user-invocable: true
metadata:

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file instructs users to place a Llama API key in LLAMA_API_KEY, which involves credential handling. Under the markdown variant of SQP-2, documentation should warn about behaviors affecting privacy or system integrity; here there is no caution about protecting the key, avoiding commits, or limiting exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.