claude-to-im Security Audit Report
claude-to-im is an AI agent skill, created by op7418 and published at op7418/claude-to-im-skill. ClawSecure audited claude-to-im across 38 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 0/100 (High Risk). The 19 findings concentrate in Data Exfiltration, Command Injection and Policy Violation, including Suspicious Pattern: Function(' and Suspicious Pattern: execSync(. 14 were rated high or critical severity.
Is claude-to-im safe?
ClawSecure audited claude-to-im and assigned a security score of 0/100 (High Risk), identifying 19 findings across Data Exfiltration and Command Injection. Review the findings below before installing.
What did ClawSecure find in claude-to-im?
ClawSecure identified 19 findings in claude-to-im, concentrated in Data Exfiltration, Command Injection and Policy Violation. 14 were rated high or critical severity. The most severe include Suspicious Pattern: Function(' and Suspicious Pattern: execSync(.
How was claude-to-im audited?
ClawSecure ran claude-to-im through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 38 files from op7418/claude-to-im-skill.
What does a score of 0 mean?
ClawSecure assigned claude-to-im a security score of 0/100, placing it in the High Risk range. This is driven by 19 findings led by Data Exfiltration that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).
Audit Findings for claude-to-im
ClawSecure detected 19 security findings in claude-to-im, spanning Data Exfiltration, Command Injection, Policy Violation and Permissions Manifest.
- critical · Suspicious Pattern: Function('. Command Injection finding detected in
src/codex-provider.ts:89. - critical · Suspicious Pattern: execSync(. Command Injection finding detected in
src/llm-provider.ts:155. - critical · Suspicious Pattern: execSync(. Command Injection finding detected in
src/llm-provider.ts:179. - critical · Suspicious Pattern: execSync(. Command Injection finding detected in
src/llm-provider.ts:267. - critical · Suspicious Pattern: execSync(. Command Injection finding detected in
src/llm-provider.ts:273. - high · Only 59% of skill content could be analyzed. 15 of 38 files…. Policy Violation finding.
- high · Suspicious Pattern: fs.writeFileSync(. Data Exfiltration finding detected in
src/codex-provider.ts:160. - high · Suspicious Pattern: fs.readFileSync(. Data Exfiltration finding detected in
src/config.ts:70. - high · Suspicious Pattern: fs.writeFileSync(. Data Exfiltration finding detected in
src/config.ts:165. - high · Suspicious Pattern: fs.readFileSync(. Data Exfiltration finding detected in
src/main.ts:110. - high · Suspicious Pattern: fs.writeFileSync(. Data Exfiltration finding detected in
src/main.ts:113. - high · Suspicious Pattern: fs.writeFileSync(. Data Exfiltration finding detected in
src/main.ts:143.
Showing the 12 highest-severity of 19 findings. The full interactive list appears below.
3-Layer Audit Protocol
Security Recommendations for claude-to-im
Audit external network connections
Harden command execution
Resolve policy violations
Related Security Research
ClawHavoc Explained: The Malware Family Targeting AI Agents→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→Related AI Agent Security Audits
Scanned on March 16, 2026. claude-to-im is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.