Llm Provider Ai Tool Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:26 AM UTC
• Version: 1.0.0

Overview

The skill is a documentation-only LLM API helper, but it asks users to send API keys, prompts, and uploaded files to an unverified third-party endpoint with weak disclosure and broad activation wording.

Review this skill before installing. Use it only if you intentionally trust llm-provider.com with your API key, prompts, generated content, and any uploaded files. Do not run the examples with production keys or confidential documents unless the provider, retention terms, deletion process, and package provenance are verified; prefer scoped, revocable keys and avoid untrusted proxy URLs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:166

Finding

OpenAI API Credential Transmitted to an Unverified Third-Party Domain

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:166-167
Additional Occurrences: SKILL.md:76-83, SKILL.md:122-123, SKILL.md:173-174
Vulnerability Type: Credential disclosure to a third-party service
Risk Level: High

bash

curl https://api.llm-provider.com/v1/models \
  -H "Authorization: Bearer $OPENAI_API_KEY" | jq '.data[0:3]'

Technical Analysis

The Skill directs the user or executing agent to place a credential named OPENAI_API_KEY in an HTTP Authorization header sent to api.llm-provider.com. The project contains no evidence establishing that this domain is an official OpenAI endpoint or is otherwise authorized to receive OpenAI credentials.

Bearer tokens provide possession-based authorization. Consequently, any service receiving the header can capture and potentially reuse the token without requiring additional proof of identity. The same credential-forwarding pattern appears in the documented file, assistant, image-generation, model-listing, and chat-completion requests.

Attack Path

1. A user configures a valid OpenAI API key in the OPENAI_API_KEY environment variable as instructed by the Skill.
2. The user or agent executes one of the documented curl commands.
3. The shell expands $OPENAI_API_KEY into the bearer authorization header.
4. The credential is transmitted to api.llm-provider.com.
5. An operator controlling or compromising that endpoint captures the bearer token.
6. The captured token may be replayed against services that accept it until the credential is revoked or expires.

Impact Assessment

A successful exploit could grant the recipient the API privileges assigned to the exposed key. Depending on the key's permissions and provider controls, this may enable unauthorized API requests, access to associated resources, consumption of paid quotas, financial loss, and exposure of account-related data. The scope is limited by the permissions, rate ...[truncated 116 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the endpoint with the API provider's verified official endpoint.
• Never transmit an OpenAI credential to an unrelated domain.
• If llm-provider.com is a separate service, require a distinct provider-specific credential such as LLM_PROVIDER_API_KEY.
• Clearly disclose the endpoint owner, authentication model, privacy policy, and trust boundary before requesting credentials.
• Require explicit user confirmation before sending credentials to any remote service.
• Recommend restricted, revocable, short-lived credentials with minimal scopes and spending limits.
• Add host allowlisting so credentials can only be sent to explicitly approved domains.
• Instruct affected users to revoke and rotate any OpenAI keys previously used with these commands and review usage logs for unauthorized requests.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:76

Finding

Local Documents Uploaded to an Unverified External Service Without Data-Handling Disclosure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:76-79
Vulnerability Type: Sensitive file disclosure to an external service
Risk Level: High

bash

curl -X POST "https://api.llm-provider.com/v1/files" \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -F "purpose=assistants" \
  -F "file=@./knowledge.pdf"

Technical Analysis

The documented workflow uploads the local file ./knowledge.pdf to api.llm-provider.com. The project does not establish the endpoint's ownership or provide privacy, retention, deletion, residency, or secondary-use terms. It also does not require the user to inspect the file for sensitive information or explicitly consent to its disclosure.

The @./knowledge.pdf syntax causes curl to read the local file and include its contents in a multipart request. This creates a direct data-exfiltration path when the command is executed. The request simultaneously transmits the bearer credential described in the preceding finding.

Attack Path

1. A user places personal, proprietary, or confidential content in knowledge.pdf.
2. The user follows the Skill's knowledge-assistant example.
3. curl reads the local document through the @./knowledge.pdf file-upload directive.
4. The document and bearer credential are transmitted to api.llm-provider.com.
5. The endpoint operator, or an attacker who has compromised the endpoint, receives the complete document.
6. The recipient may retain, inspect, process, or redistribute the content outside the user's intended trust boundary.

Impact Assessment

The external service can obtain the entire uploaded document. Potentially exposed information includes personal data, business records, intellectual property, internal instructions, customer data, and credentials embedded in the document. This does not directly grant local system privileges, but it grants the recipient access to all information contained in the selected file. The orga ...[truncated 129 chars]

Remediation

View remediation

Remediation Suggestions

• Use only a verified service whose ownership and data-processing terms are documented.
• Require informed, explicit user approval before uploading any local file.
• Display the destination hostname and selected file path before transmission.
• Warn users not to upload secrets, regulated data, personal information, or confidential documents.
• Implement content classification and secret scanning before upload.
• Document retention periods, deletion procedures, geographic processing locations, encryption controls, and whether uploaded data is used for model training.
• Support client-side redaction and least-data upload instead of sending complete source documents.
• Provide a local-processing option where feasible.
• Remove previously uploaded sensitive files and rotate any credentials included in them or transmitted alongside them.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:290

Finding

Unpinned and Unverified Python and Node.js Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:290-291
Related Invalid Imports: SKILL.md:98, SKILL.md:192, SKILL.md:241
Vulnerability Type: Unsafe third-party dependency installation
Risk Level: Medium

text

| llm-provider Python SDK | Python library | Recommended | `pip install llm-provider` |
| llm-provider Node SDK | npm library | Recommended (Node use cases) | `npm install llm-provider` |

The document also presents imports such as:

python

from llm-provider import llm-provider

Technical Analysis

The Skill recommends installing packages named llm-provider from the default Python and npm public registries without specifying exact versions, integrity hashes, verified publishers, signed releases, or an authenticated source repository. These commands therefore resolve to whichever mutable package release the registries currently serve.

Generic, identical package names across ecosystems increase supply-chain ambiguity. If the referenced package is malicious, compromised, transferred to another publisher, or replaced through dependency confusion or typosquatting, installation may execute attacker-controlled package hooks. Subsequent imports may also execute arbitrary module initialization code.

The demonstrated Python import uses hyphens in an import statement, which is not valid conventional Python syntax. This inconsistency further undermines confidence that the documented package and examples were verified against an authentic SDK.

Attack Path

1. A user trusts the Skill and runs pip install llm-provider or npm install llm-provider.
2. The package manager resolves the unpinned package from its configured public registry.
3. A malicious or compromised release is downloaded.
4. Package installation hooks or imported module initialization execute attacker-controlled code under the user's account.
5. The malicious package may access environment variables, includ ...[truncated 790 chars]

Remediation

View remediation

Remediation Suggestions

• Verify package ownership and link to an authenticated official source repository and registry publisher.
• Pin dependencies to reviewed exact versions rather than mutable latest releases.
• For Python, provide locked versions and verified hashes, such as through a hash-checked requirements file.
• For npm, commit and enforce a reviewed lockfile with integrity metadata.
• Verify package signatures or provenance attestations where supported.
• Disable or review package installation scripts when operationally possible.
• Install dependencies in an isolated, least-privileged virtual environment or container.
• Correct the Python examples to use a valid, verified module import name.
• Add automated dependency scanning and update only after review.
• Do not expose production API keys or sensitive files to untrusted installation environments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The examples instruct users to upload personal documents and create assistants via a remote third-party API, but do not clearly warn that document contents and prompts will leave the local environment. Because the skill is marketed for personal developers and document Q&A, this omission materially increases the risk of unintended disclosure of sensitive files, proprietary data, or regulated information.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger condition is extremely broad ('需要AI模型调用、智能对话、Agent编排、LLM应用时使用'), which overlaps with many ordinary user requests and can cause the skill to activate in unintended contexts. In an agent platform, overbroad activation increases the chance that user prompts, documents, or secrets are routed into this skill and then onward to external APIs without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The capability coverage section lists a very broad set of keywords such as 'OpenAI', 'API', 'chat', 'embeddings', and '图像生成' without clear constraints or opt-in boundaries. This makes accidental invocation more likely and weakens the user's ability to understand when the skill will perform remote operations or handle sensitive content.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The referenced domain is an external service endpoint used for file upload, meaning local content is intentionally transferred outside the agent environment. The danger is increased here because the skill frames document upload as a common use case but omits any privacy or compliance boundary around what should not be sent.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

bash

# 上传知识文件
curl -X POST "https://api.llm-provider.com/v1/files" \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -F "purpose=assistants" \
  -F "file=@./knowledge.pdf"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The referenced domain is an external service endpoint used for file upload, meaning local content is intentionally transferred outside the agent environment. The danger is increased here because the skill frames document upload as a common use case but omits any privacy or compliance boundary around what should not be sent.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

bash

# 上传知识文件
curl -X POST "https://api.llm-provider.com/v1/files" \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -F "purpose=assistants" \
  -F "file=@./knowledge.pdf"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

-F "file=@./knowledge.pdf"

# 创建助手并绑定文件
curl -X POST "https://api.llm-provider.com/v1/assistants" \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md

-F "file=@./knowledge.pdf"

# 创建助手并绑定文件
curl -X POST "https://api.llm-provider.com/v1/assistants" \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md

-F "file=@./knowledge.pdf"

# 创建助手并绑定文件
curl -X POST "https://api.llm-provider.com/v1/assistants" \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill tells users to configure an API key and even shows a custom proxy/base URL option, but does not warn about credential theft, logging exposure, or man-in-the-middle risk from untrusted proxies. In this context, encouraging proxy use without trust guidance is especially dangerous because it can expose both API keys and all prompt/file traffic to third parties.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The chat completion example sends prompt content to a remote API, which can expose confidential text entered by the user or included from surrounding context. Although remote inference is the feature's intended purpose, the risk is real because the skill does not clearly require consent or caution users about sending sensitive material.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

3. 发起第一次对话

bash

curl -X POST "https://api.llm-provider.com/v1/chat/completions" \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The chat completion example sends prompt content to a remote API, which can expose confidential text entered by the user or included from surrounding context. Although remote inference is the feature's intended purpose, the risk is real because the skill does not clearly require consent or caution users about sending sensitive material.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

3. 发起第一次对话

bash

curl -X POST "https://api.llm-provider.com/v1/chat/completions" \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

L179 的 system 消息写明“你是一个友好的中文助手”，这在自然语言层面预设了输出语言，但文档没有说明这是可选示例，也没有为用户提供语言/区域选择。根据语言与 locale 策略，这种默认强制特定语言的做法可能构成策略违例。

Content

No source excerpt is available for this finding.