Jules CLI

ReviewAudited by ClawScan on May 1, 2026.

Overview

This is a coherent Jules CLI helper, but it can start remote coding sessions, use account login, and apply remote code changes, so users should approve those actions deliberately.

Install this only if you already trust the Jules CLI and want the agent to delegate complex coding work to a remote VM. Require explicit approval for new sessions, pull --apply, teleport, and login; verify repository/session IDs; and review/test changes after pulling them.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If approved, the agent can ask Jules to work on a repository remotely and then apply the resulting changes to the local codebase.

Why it was flagged

The skill exposes high-impact CLI actions that create remote sessions and modify local code, but it explicitly requires user approval for those actions.

Skill content

Approval Required (MANDATORY): ... `jules remote new`: Since this creates a remote session/VM. ... `jules remote pull --apply`: Since this modifies the local codebase. ... `jules teleport`: Since this clones and modifies the environment.

Recommendation

Approve these commands only for intended repositories and review/test any pulled changes before relying on them.

Low

#ASI03: Identity and Privilege Abuse

What this means

The CLI may use your existing Jules/GitHub-related account access to list repositories, create sessions, and pull results.

Why it was flagged

The skill may rely on the user's Jules account state under HOME or prompt for Jules login, which is expected for this integration and is paired with a confirmation requirement.

Skill content

env:
  - HOME
...
Credentials: If `jules login` is required, explain *why* to the user and wait for their confirmation before proceeding.

Recommendation

Use this only with an account and repositories you intend to grant Jules access to, and confirm any login step knowingly.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

A user with the wrong or untrusted `jules` binary installed could run unintended software when following the skill.

Why it was flagged

The skill does not install or verify the Jules CLI itself, so trust depends on the user's existing local CLI installation and PATH.

Skill content

Source: unknown
Homepage: none
...
No install spec — this is an instruction-only skill.

Recommendation

Install Jules from a trusted source separately and verify the `jules` command on PATH before using the skill.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Repository names, task descriptions, and code accessible to the Jules session may be handled outside the local environment.

Why it was flagged

The workflow sends repository identity and task instructions to a remote Jules environment, creating an external data boundary that is central to the skill's purpose.

Skill content

Use this skill sparingly for complex, isolated tasks that benefit from a remote VM.
...
jules remote new --repo "<repo>" --session "Detailed task description" < /dev/null

Recommendation

Avoid using the skill for repositories or task details that should not be shared with the Jules remote service.