Luke Blucli

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is a straightforward BluOS speaker-control wrapper, with the main caution that it installs an external CLI package and can change playback, volume, and groups on local devices.

This appears safe for its stated purpose. Before installing, be aware it uses an external Go-installed `blu` CLI and can make real changes to BluOS speakers, so confirm the target device before playback, volume, or grouping actions.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

The agent could change music playback, volume, or speaker groups if invoked for those tasks.

Why it was flagged

The skill exposes commands that can change playback, volume, and speaker grouping. This is aligned with the BluOS-control purpose and includes a target-confirmation instruction, but users should recognize it can affect real devices.

Skill content

`blu play|pause|stop`; `blu volume set 15`; `blu group status|add|remove`; `Confirm the target device before changing playback.`

Recommendation

Confirm the target device and intended action before allowing playback, volume, or grouping changes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Future installs could retrieve a different version of the BluOS CLI than the one originally reviewed.

Why it was flagged

The skill installs the required `blu` binary from an external Go module using the moving `@latest` version. This is central to the skill, but the installed code is not pinned to a specific version in the artifacts.

Skill content

module: github.com/steipete/blucli/cmd/blu@latest

Recommendation

Prefer a pinned module version or verify the upstream project before installing.