Security audit

llama.cpp Provider

Security checks for vulnerabilities and agentic risk

Overview

This package coherently implements a llama.cpp model provider with disclosed local server setup, model downloads, and optional external-server authentication.

Install only if you want OpenClaw to manage or connect to a llama.cpp server. During setup, review the prompts because managed mode can download multi-GB model/runtime files and external-server mode may store an API key for that server.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/index.js:409
Evidence: execFile(command, args, {

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/index.js:1871
Evidence: const apiKey = [REDACTED]) ? await resolveLlamaServerRuntimeApiKey({ config: ctx.config }) : void 0;