medusa is an AI agent skill, created by Pantheon-Security and published at Pantheon-Security/medusa. ClawSecure audited medusa across 62 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 0/100 (High Risk). The 19 findings concentrate in Code Injection, Malicious Code and Permissions Manifest, including Attempts to access sensitive file: .ssh/ and Attempts to access sensitive file: .ssh/. 18 were rated high or critical severity.
Is medusa safe?
ClawSecure audited medusa and assigned a security score of 0/100 (High Risk), identifying 19 findings across Code Injection and Malicious Code. Review the findings below before installing.
What did ClawSecure find in medusa?
ClawSecure identified 19 findings in medusa, concentrated in Code Injection, Malicious Code and Permissions Manifest. 18 were rated high or critical severity. The most severe include Attempts to access sensitive file: .ssh/ and Attempts to access sensitive file: .ssh/.
How was medusa audited?
ClawSecure ran medusa through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 62 files from Pantheon-Security/medusa.
What does a score of 0 mean?
ClawSecure assigned medusa a security score of 0/100, placing it in the High Risk range. This is driven by 19 findings led by Code Injection that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).
Audit Findings for medusa
ClawSecure detected 19 security findings in medusa, spanning Code Injection, Malicious Code and Permissions Manifest.
- high · Attempts to access sensitive file: .ssh/. Malicious Code finding detected in
AI_SECURITY.md. - high · Attempts to access sensitive file: .ssh/. Malicious Code finding detected in
ISSUES.md. - high · Potentially dangerous code pattern detected: curl.*\|.*sh. Code Injection finding detected in
CHANGELOG.md. - high · Potentially dangerous code pattern detected: exec\(. Code Injection finding detected in
CHANGELOG.md. - high · Potentially dangerous code pattern detected: curl.*\|.*sh. Code Injection finding detected in
README.md. - high · Potentially dangerous code pattern detected: eval\(. Code Injection finding detected in
AI_SECURITY.md. - high · Potentially dangerous code pattern detected: exec\(. Code Injection finding detected in
AI_SECURITY.md. - high · Potentially dangerous code pattern detected: eval\(. Code Injection finding detected in
CVEMINER_WISHLIST.md. - high · Potentially dangerous code pattern detected: curl.*\|.*sh. Code Injection finding detected in
INSTALLATION.md. - high · Potentially dangerous code pattern detected: eval\(. Code Injection finding detected in
SCANNERS.md. - high · Potentially dangerous code pattern detected: system\(. Code Injection finding detected in
SCANNERS.md. - high · Potentially dangerous code pattern detected: curl.*\|.*sh. Code Injection finding detected in
TROUBLESHOOTING.md.
Showing the 12 highest-severity of 19 findings. The full interactive list appears below.
3-Layer Audit Protocol
Security Recommendations for medusa
Eliminate dynamic code execution
Audit external network connections
Add a config.json permissions manifest
Related Security Research
Why Generic Scanners Fail at AI Agent Security→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→Related AI Agent Security Audits
Scanned on June 24, 2026. medusa is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.