grab is an AI agent skill, created by jamesalmeida and published at jamesalmeida/grab. ClawSecure audited grab across 7 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 20/100 (High Risk). The 14 findings concentrate in Command Injection, Policy Violation and Data Exfiltration, including Variable $tweet_id (tainted at line 42: `tweet_id=$(echo "$url" | grep... and Variable $clean_url (line 8) flows to `curl` at line 19.. 1 was rated high or critical severity.
Is grab safe?
ClawSecure audited grab and assigned a security score of 20/100 (High Risk), identifying 14 findings across Command Injection and Policy Violation. Review the findings below before installing.
What did ClawSecure find in grab?
ClawSecure identified 14 findings in grab, concentrated in Command Injection, Policy Violation and Data Exfiltration. 1 was rated high or critical severity. The most severe include Variable $tweet_id (tainted at line 42: `tweet_id=$(echo "$url" | grep... and Variable $clean_url (line 8) flows to `curl` at line 19..
How was grab audited?
ClawSecure ran grab through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 7 files from jamesalmeida/grab.
What does a score of 20 mean?
ClawSecure assigned grab a security score of 20/100, placing it in the High Risk range. This is driven by 14 findings led by Command Injection that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).
Audit Findings for grab
ClawSecure detected 14 security findings in grab, spanning Command Injection, Policy Violation, Data Exfiltration and Permissions Manifest.
- critical · Variable $tweet_id (tainted at line 42: `tweet_id=$(echo "$url" | grep.... Data Exfiltration finding detected in
scripts/lib/tweet.sh:47. - medium · Variable $clean_url (line 8) flows to `curl` at line 19.. Command Injection finding detected in
scripts/lib/reddit.sh:19. - medium · Variable $json_data (line 19) flows to `python3` at line 21.. Command Injection finding detected in
scripts/lib/reddit.sh:21. - medium · Variable $tmp_json (line 15) flows to `python3` at line 42.. Command Injection finding detected in
scripts/lib/reddit.sh:42. - medium · Variable $tmp_parsed (line 16) flows to `python3` at line 153.. Command Injection finding detected in
scripts/lib/reddit.sh:153. - medium · Variable $tmp_parsed (line 16) flows to `python3` at line 174.. Command Injection finding detected in
scripts/lib/reddit.sh:174. - medium · Variable $tmp_parsed (line 16) flows to `python3` at line 178.. Command Injection finding detected in
scripts/lib/reddit.sh:178. - medium · Variable $synd (tainted at line 47: `synd=$(curl -sS.... Command Injection finding detected in
scripts/lib/tweet.sh:50. - medium · Variable $synd (tainted at line 47: `synd=$(curl -sS.... Command Injection finding detected in
scripts/lib/tweet.sh:51. - medium · Variable $synd (tainted at line 47: `synd=$(curl -sS.... Command Injection finding detected in
scripts/lib/tweet.sh:52. - medium · Variable $synd (tainted at line 47: `synd=$(curl -sS.... Command Injection finding detected in
scripts/lib/tweet.sh:53. - medium · Variable $synd (tainted at line 47: `synd=$(curl -sS.... Command Injection finding detected in
scripts/lib/tweet.sh:57.
Showing the 12 highest-severity of 14 findings. The full interactive list appears below.
3-Layer Audit Protocol
Security Recommendations for grab
Harden command execution
Resolve policy violations
Audit external network connections
Related Security Research
Why Generic Scanners Fail at AI Agent Security→Understanding Our 3-Layer Audit Protocol→Related AI Agent Security Audits
Scanned on May 4, 2026. grab is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.