clawdtm is an AI agent skill, created by 0xmythril and published at 0xmythril/clawdtm. ClawSecure audited clawdtm across 102 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 13/100 (High Risk). The 13 findings concentrate in Supply Chain, Code Injection and Permissions Manifest, including Vulnerability in @clerk/nextjs@6.37.1: Official Clerk JavaScript SDKs:... and Potentially dangerous code pattern detected: curl.*\|.*sh. 7 were rated high or critical severity.
Is clawdtm safe?
ClawSecure audited clawdtm and assigned a security score of 13/100 (High Risk), identifying 13 findings across Supply Chain and Code Injection. Review the findings below before installing.
What did ClawSecure find in clawdtm?
ClawSecure identified 13 findings in clawdtm, concentrated in Supply Chain, Code Injection and Permissions Manifest. 7 were rated high or critical severity. The most severe include Vulnerability in @clerk/nextjs@6.37.1: Official Clerk JavaScript SDKs:... and Potentially dangerous code pattern detected: curl.*\|.*sh.
How was clawdtm audited?
ClawSecure ran clawdtm through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 102 files from 0xmythril/clawdtm.
What does a score of 13 mean?
ClawSecure assigned clawdtm a security score of 13/100, placing it in the High Risk range. This is driven by 13 findings led by Supply Chain that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).
Audit Findings for clawdtm
ClawSecure detected 13 security findings in clawdtm, spanning Supply Chain, Code Injection and Permissions Manifest.
- critical · Vulnerability in @clerk/nextjs@6.37.1: Official Clerk JavaScript SDKs:.... Supply Chain finding detected in
package.json. - high · Potentially dangerous code pattern detected: curl.*\|.*sh. Code Injection finding detected in
security.ts. - high · Potentially dangerous code pattern detected: wget.*\|.*sh. Code Injection finding detected in
security.ts. - high · Potentially dangerous code pattern detected: eval\(. Code Injection finding detected in
security.ts. - high · Potentially dangerous code pattern detected: exec\(. Code Injection finding detected in
security.ts. - high · Potentially dangerous code pattern detected: system\(. Code Injection finding detected in
security.ts. - high · Vulnerability in next@16.1.5: Next.js has a Denial of Service with.... Supply Chain finding detected in
package.json. - medium · Missing config.json - agent may not be properly configured. Permissions Manifest finding.
- low · Vulnerability in next@16.1.5: Next.js: null origin can bypass dev HMR.... Supply Chain finding detected in
package.json. - moderate · Vulnerability in next@16.1.5: Next.js: Unbounded next/image disk cache.... Supply Chain finding detected in
package.json. - moderate · Vulnerability in next@16.1.5: Next.js: HTTP request smuggling in.... Supply Chain finding detected in
package.json. - moderate · Vulnerability in next@16.1.5: Next.js: Unbounded postponed resume.... Supply Chain finding detected in
package.json.
Showing the 12 highest-severity of 13 findings. The full interactive list appears below.
3-Layer Audit Protocol
Security Recommendations for clawdtm
Update and pin dependencies
Eliminate dynamic code execution
Add a config.json permissions manifest
Related Security Research
AI Agent Supply Chain Attacks: How Dependencies Become Weapons→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→Related AI Agent Security Audits
Scanned on May 2, 2026. clawdtm is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.