← Back to Scanner

clui Security Audit Report

🔭 Continuously monitored by ClawSecure Watchtower
Source:
SHA-256:

clui is an AI agent skill, created by lcoutodemos and published at lcoutodemos/clui-cc. ClawSecure audited clui across 60 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 76/100 (Medium Risk). The 13 findings concentrate in Supply Chain, Code Injection and Permissions Manifest, including Potentially dangerous code pattern detected: system\( and Missing config.json - agent may not be properly configured. 1 was rated high or critical severity.

Is clui safe?

ClawSecure audited clui and assigned a security score of 76/100 (Medium Risk), identifying 13 findings across Supply Chain and Code Injection. Review the findings below before installing.

What did ClawSecure find in clui?

ClawSecure identified 13 findings in clui, concentrated in Supply Chain, Code Injection and Permissions Manifest. 1 was rated high or critical severity. The most severe include Potentially dangerous code pattern detected: system\( and Missing config.json - agent may not be properly configured.

How was clui audited?

ClawSecure ran clui through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 60 files from lcoutodemos/clui-cc.

What does a score of 76 mean?

ClawSecure assigned clui a security score of 76/100, placing it in the Medium Risk range. This reflects 13 findings led by Supply Chain that warrant review before production use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).

Audit Findings for clui

ClawSecure detected 13 security findings in clui, spanning Supply Chain, Code Injection, Permissions Manifest and ReDoS.

Showing the 12 highest-severity of 13 findings. The full interactive list appears below.

3-Layer Audit Protocol

Security Recommendations for clui

Update and pin dependencies
clui depends on packages with supply-chain risk. Pin every dependency to an exact version, update packages with known CVEs to patched releases, and re-audit after each change. ClawSecure checks every dependency against known CVE databases.
Eliminate dynamic code execution
clui evaluates code at runtime (for example eval or dynamic exec). Remove dynamic evaluation of untrusted input, and where code generation is unavoidable, sandbox it and validate every input.
Add a config.json permissions manifest
A config.json file declares what an agent component can access: file system, network, shell execution and more. Without it, users have no visibility into what the component can do before installing. This is the single most impactful security improvement for any AI agent skill.

Related Security Research

AI Agent Supply Chain Attacks: How Dependencies Become WeaponsBeyond Static Scans: Why ClawSecure Verifies Agentic Intent

Related AI Agent Security Audits

clawdhubScore 85/100everything-claude-codeScore 90/100api-gatewayScore 81/100shodan-skillScore 90/100@penpot/mcpScore 75/100

Scanned on March 26, 2026. clui is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.

Start Your Free Scan