clui is an AI agent skill, created by lcoutodemos and published at lcoutodemos/clui-cc. ClawSecure audited clui across 60 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 76/100 (Medium Risk). The 13 findings concentrate in Supply Chain, Code Injection and Permissions Manifest, including Potentially dangerous code pattern detected: system\( and Missing config.json - agent may not be properly configured. 1 was rated high or critical severity.
Is clui safe?
ClawSecure audited clui and assigned a security score of 76/100 (Medium Risk), identifying 13 findings across Supply Chain and Code Injection. Review the findings below before installing.
What did ClawSecure find in clui?
ClawSecure identified 13 findings in clui, concentrated in Supply Chain, Code Injection and Permissions Manifest. 1 was rated high or critical severity. The most severe include Potentially dangerous code pattern detected: system\( and Missing config.json - agent may not be properly configured.
How was clui audited?
ClawSecure ran clui through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 60 files from lcoutodemos/clui-cc.
What does a score of 76 mean?
ClawSecure assigned clui a security score of 76/100, placing it in the Medium Risk range. This reflects 13 findings led by Supply Chain that warrant review before production use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).
Audit Findings for clui
ClawSecure detected 13 security findings in clui, spanning Supply Chain, Code Injection, Permissions Manifest and ReDoS.
- high · Potentially dangerous code pattern detected: system\(. Code Injection finding detected in
event-normalizer.ts. - medium · Missing config.json - agent may not be properly configured. Permissions Manifest finding.
- medium · ReDoS vulnerability: Nested quantifiers (potential…. ReDoS finding detected in
pty-run-manager.ts:519. - low · Vulnerability in vite@6.0.0: Vite middleware may serve…. Supply Chain finding detected in
package.json. - low · Vulnerability in vite@6.0.0: Vite's `server.fs` settings…. Supply Chain finding detected in
package.json. - moderate · Vulnerability in postcss@8.4.0: PostCSS line return parsing…. Supply Chain finding detected in
package.json. - moderate · Vulnerability in vite@6.0.0: Vite has an `server.fs.deny`…. Supply Chain finding detected in
package.json. - moderate · Vulnerability in vite@6.0.0: Vite has a `server.fs.deny`…. Supply Chain finding detected in
package.json. - moderate · Vulnerability in vite@6.0.0: Vite's server.fs.deny bypassed…. Supply Chain finding detected in
package.json. - moderate · Vulnerability in vite@6.0.0: vite allows server.fs.deny…. Supply Chain finding detected in
package.json. - moderate · Vulnerability in vite@6.0.0: Websites were able to send any…. Supply Chain finding detected in
package.json. - moderate · Vulnerability in vite@6.0.0: Vite bypasses server.fs.deny…. Supply Chain finding detected in
package.json.
Showing the 12 highest-severity of 13 findings. The full interactive list appears below.
3-Layer Audit Protocol
Security Recommendations for clui
Update and pin dependencies
Eliminate dynamic code execution
Add a config.json permissions manifest
Related Security Research
AI Agent Supply Chain Attacks: How Dependencies Become Weapons→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→Related AI Agent Security Audits
Scanned on March 26, 2026. clui is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.