understand-anything Security Audit Report
understand-anything is an AI agent skill, created by Lum1104 and published at Lum1104/Understand-Anything. ClawSecure audited understand-anything across 54 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 75/100 (Medium Risk). The 4 findings concentrate in ReDoS, Permissions Manifest and Code Injection, including Potentially dangerous code pattern detected: exec\( and Missing config.json - agent may not be properly configured. 1 was rated high or critical severity.
Is understand-anything safe?
ClawSecure audited understand-anything and assigned a security score of 75/100 (Medium Risk), identifying 4 findings across ReDoS and Permissions Manifest. Review the findings below before installing.
What did ClawSecure find in understand-anything?
ClawSecure identified 4 findings in understand-anything, concentrated in ReDoS, Permissions Manifest and Code Injection. 1 was rated high or critical severity. The most severe include Potentially dangerous code pattern detected: exec\( and Missing config.json - agent may not be properly configured.
How was understand-anything audited?
ClawSecure ran understand-anything through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 54 files from Lum1104/Understand-Anything.
What does a score of 75 mean?
ClawSecure assigned understand-anything a security score of 75/100, placing it in the Medium Risk range. This reflects 4 findings led by ReDoS that warrant review before production use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).
Audit Findings for understand-anything
ClawSecure detected 4 security findings in understand-anything, spanning ReDoS, Permissions Manifest and Code Injection.
- high · Potentially dangerous code pattern detected: exec\(. Code Injection finding detected in
2026-03-28-understand-anything-extension-impl.md. - medium · Missing config.json - agent may not be properly configured. Permissions Manifest finding.
- medium · ReDoS vulnerability: Nested quantifiers (potential catastrophic.... ReDoS finding detected in
2026-03-14-phase1-implementation.md:2068. - medium · ReDoS vulnerability: Nested quantifiers (potential catastrophic.... ReDoS finding detected in
2026-03-26-theme-system-implementation.md:56.
Each finding is expandable in the interactive list below.
3-Layer Audit Protocol
Security Recommendations for understand-anything
Fix ReDoS-prone patterns
Add a config.json permissions manifest
Eliminate dynamic code execution
Pin dependencies to exact versions
1.2.3 instead of ^1.2.3) to keep unauthorized code out of your dependency tree. ClawSecure checks every dependency against known CVE databases.Related Security Research
Why Generic Scanners Fail at AI Agent Security→Understanding Our 3-Layer Audit Protocol→How to Secure an MCP Server: The 2026 Guide→Related AI Agent Security Audits
Scanned on April 17, 2026. understand-anything is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.