byterover-cli Security Audit Report
byterover-cli is an AI agent skill, created by ByteRover and published at campfirein/byterover-cli. ClawSecure audited byterover-cli across 106 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 0/100 (High Risk). The 18 findings concentrate in Code Injection, Supply Chain and Permissions Manifest, including Potentially dangerous code pattern detected: curl.*\|.*sh and Potentially dangerous code pattern detected: curl.*\|.*sh. 13 were rated high or critical severity.
Is byterover-cli safe?
ClawSecure audited byterover-cli and assigned a security score of 0/100 (High Risk), identifying 18 findings across Code Injection and Supply Chain. Review the findings below before installing.
What did ClawSecure find in byterover-cli?
ClawSecure identified 18 findings in byterover-cli, concentrated in Code Injection, Supply Chain and Permissions Manifest. 13 were rated high or critical severity. The most severe include Potentially dangerous code pattern detected: curl.*\|.*sh and Potentially dangerous code pattern detected: curl.*\|.*sh.
How was byterover-cli audited?
ClawSecure ran byterover-cli through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 106 files from campfirein/byterover-cli.
What does a score of 0 mean?
ClawSecure assigned byterover-cli a security score of 0/100, placing it in the High Risk range. This is driven by 18 findings led by Code Injection that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).
Audit Findings for byterover-cli
ClawSecure detected 18 security findings in byterover-cli, spanning Code Injection, Supply Chain and Permissions Manifest.
- high · Potentially dangerous code pattern detected: curl.*\|.*sh. Code Injection finding detected in
CHANGELOG.md. - high · Potentially dangerous code pattern detected: curl.*\|.*sh. Code Injection finding detected in
README.md. - high · Potentially dangerous code pattern detected: curl.*\|.*sh. Code Injection finding detected in
install.sh. - high · Potentially dangerous code pattern detected: curl.*\|.*sh. Code Injection finding detected in
openclaw-setup.sh. - high · Potentially dangerous code pattern detected: curl.*\|.*sh. Code Injection finding detected in
uninstall.sh. - high · Potentially dangerous code pattern detected: eval\(. Code Injection finding detected in
query.ts. - high · Potentially dangerous code pattern detected: exec\(. Code Injection finding detected in
restart.ts. - high · Potentially dangerous code pattern detected: eval\(. Code Injection finding detected in
query-retrieval.ts. - high · Potentially dangerous code pattern detected: exec\(. Code Injection finding detected in
time-filter.ts. - high · Potentially dangerous code pattern detected: exec\(. Code Injection finding detected in
curate-result-parser.ts. - high · Vulnerability in glob@11.0.3: glob CLI: Command injection via -c/--cmd.... Supply Chain finding detected in
package.json. - high · Vulnerability in lodash-es@4.17.22: lodash vulnerable to Code Injection.... Supply Chain finding detected in
package.json.
Showing the 12 highest-severity of 18 findings. The full interactive list appears below.
3-Layer Audit Protocol
Security Recommendations for byterover-cli
Eliminate dynamic code execution
Update and pin dependencies
Add a config.json permissions manifest
Related Security Research
Why Generic Scanners Fail at AI Agent Security→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→Related AI Agent Security Audits
Scanned on June 25, 2026. byterover-cli is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.