← Back to Scanner

clawdtm Security Audit Report

🔭 Continuously monitored by ClawSecure Watchtower
Source:
SHA-256:

clawdtm is an AI agent skill, created by 0xmythril and published at 0xmythril/clawdtm. ClawSecure audited clawdtm across 102 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 13/100 (High Risk). The 13 findings concentrate in Supply Chain, Code Injection and Permissions Manifest, including Vulnerability in @clerk/nextjs@6.37.1: Official Clerk JavaScript SDKs:... and Potentially dangerous code pattern detected: curl.*\|.*sh. 7 were rated high or critical severity.

Is clawdtm safe?

ClawSecure audited clawdtm and assigned a security score of 13/100 (High Risk), identifying 13 findings across Supply Chain and Code Injection. Review the findings below before installing.

What did ClawSecure find in clawdtm?

ClawSecure identified 13 findings in clawdtm, concentrated in Supply Chain, Code Injection and Permissions Manifest. 7 were rated high or critical severity. The most severe include Vulnerability in @clerk/nextjs@6.37.1: Official Clerk JavaScript SDKs:... and Potentially dangerous code pattern detected: curl.*\|.*sh.

How was clawdtm audited?

ClawSecure ran clawdtm through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 102 files from 0xmythril/clawdtm.

What does a score of 13 mean?

ClawSecure assigned clawdtm a security score of 13/100, placing it in the High Risk range. This is driven by 13 findings led by Supply Chain that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).

Audit Findings for clawdtm

ClawSecure detected 13 security findings in clawdtm, spanning Supply Chain, Code Injection and Permissions Manifest.

Showing the 12 highest-severity of 13 findings. The full interactive list appears below.

3-Layer Audit Protocol

Security Recommendations for clawdtm

Update and pin dependencies
clawdtm depends on packages with supply-chain risk. Pin every dependency to an exact version, update packages with known CVEs to patched releases, and re-audit after each change. ClawSecure checks every dependency against known CVE databases.
Eliminate dynamic code execution
clawdtm evaluates code at runtime (for example eval or dynamic exec). Remove dynamic evaluation of untrusted input, and where code generation is unavoidable, sandbox it and validate every input.
Add a config.json permissions manifest
A config.json file declares what an agent component can access: file system, network, shell execution and more. Without it, users have no visibility into what the component can do before installing. This is the single most impactful security improvement for any AI agent skill.

Related Security Research

AI Agent Supply Chain Attacks: How Dependencies Become WeaponsBeyond Static Scans: Why ClawSecure Verifies Agentic Intent

Related AI Agent Security Audits

fzfScore 25/100awesome-openclaw-skillsScore 0/100memUScore 0/100understand-anythingScore 0/10062ac696296b54aadScore 0/100

Scanned on May 2, 2026. clawdtm is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.

Start Your Free Scan