clawlink is an AI agent skill, created by davemorin and published at davemorin/clawlink. ClawSecure audited clawlink across 35 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 0/100 (High Risk). The 32 findings concentrate in Data Exfiltration, Command Injection and Code Injection, including Pattern detected: from 'child_process' and Pattern detected: execSync(. 13 were rated high or critical severity.
Is clawlink safe?
ClawSecure audited clawlink and assigned a security score of 0/100 (High Risk), identifying 32 findings across Data Exfiltration and Command Injection. Review the findings below before installing.
What did ClawSecure find in clawlink?
ClawSecure identified 32 findings in clawlink, concentrated in Data Exfiltration, Command Injection and Code Injection. 13 were rated high or critical severity. The most severe include Pattern detected: from 'child_process' and Pattern detected: execSync(.
How was clawlink audited?
ClawSecure ran clawlink through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 35 files from davemorin/clawlink.
What does a score of 0 mean?
ClawSecure assigned clawlink a security score of 0/100, placing it in the High Risk range. This is driven by 32 findings led by Data Exfiltration that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).
Audit Findings for clawlink
ClawSecure detected 32 security findings in clawlink, spanning Data Exfiltration, Command Injection, Code Injection and Policy Violation.
- critical · Pattern detected: from 'child_process'. Command Injection finding detected in
cli.js:10. - critical · Pattern detected: execSync(. Command Injection finding detected in
cli.js:27. - critical · Pattern detected: execSync(. Command Injection finding detected in
cli.js:52. - critical · Pattern detected: execSync(. Command Injection finding detected in
cli.js:57. - critical · Pattern detected: execSync(. Command Injection finding detected in
cli.js:68. - critical · Pattern detected: execSync(. Command Injection finding detected in
cli.js:74. - critical · Pattern detected: execSync(. Command Injection finding detected in
cli.js:79. - critical · Pattern detected: from 'child_process'. Command Injection finding detected in
scripts/install.js:15. - critical · Pattern detected: execSync(. Command Injection finding detected in
scripts/install.js:56. - high · Only 23% of skill content could be analyzed. 26 of 35 files are opaque.... Policy Violation finding.
- high · Potentially dangerous code pattern detected: base64.*decode. Code Injection finding detected in
crypto.js. - high · Potentially dangerous code pattern detected: base64.*decode. Code Injection finding detected in
debug-relay.js.
Showing the 12 highest-severity of 32 findings. The full interactive list appears below.
3-Layer Audit Protocol
Security Recommendations for clawlink
Audit external network connections
Harden command execution
Eliminate dynamic code execution
Related Security Research
ClawHavoc Explained: The Malware Family Targeting AI Agents→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→Related AI Agent Security Audits
Scanned on May 4, 2026. clawlink is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.