ClawHub
Back to skill

Security audit

Luke Blucli

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small, disclosed helper for installing and using the blu CLI to control BluOS devices, with a supply-chain caution because it installs the CLI from a mutable upstream version.

Install only if you are comfortable trusting the upstream blucli Go module and allowing a CLI to discover and control BluOS/Bluesound/NAD devices on your network. Prefer a pinned reviewed version if your environment requires reproducible installs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned Third-Party CLI Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned executable dependency from a mutable upstream source
Risk Level: Medium

Vulnerable Code Snippet:

yaml
metadata: {"clawdbot":{"emoji":"🫐","requires":{"bins":["blu"]},"install":[{"id":"go","kind":"go","module":"github.com/steipete/blucli/cmd/blu@latest","bins":["blu"],"label":"Install blucli (go)"}]}}

Technical Analysis

The installation metadata retrieves github.com/steipete/blucli/cmd/blu@latest. The @latest selector is mutable and can resolve to a different release each time the Skill is installed. Consequently, the code ultimately installed and executed is not the same fixed artifact reviewed during this audit.

This creates a third-party supply-chain risk. If the upstream repository, maintainer account, release process, or one of its dependencies is compromised, a malicious release could become the version selected by @latest. The Skill would then install that unaudited version without requiring any change to the audited package.

Attack Path

  1. An attacker compromises the upstream repository, maintainer credentials, release pipeline, or relevant dependency chain.
  2. The attacker publishes a malicious version that becomes the Go module version resolved by @latest.
  3. A user installs the Skill, causing the installation mechanism to retrieve and build the new upstream version.
  4. The resulting blu executable is placed in the user's executable path.
  5. When the user or agent invokes blu, the malicious code executes with the privileges of that user.
  6. The payload could access user-readable local resources, communicate over the network, or issue unauthorized commands to reachable Bluesound/NAD devices.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the account that invokes the installed CLI. The accessible scope would include files, environment va ...[truncated 298 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact, reviewed semantic version, for example:

    yaml
    "module":"github.com/steipete/blucli/cmd/blu@vX.Y.Z"

  2. Review the source and transitive dependency changes before updating the pinned version.

  3. Preserve and verify Go module checksums through go.sum or an equivalent trusted checksum policy where the installation framework supports it.

  4. Prefer signed releases, verified provenance, or reproducible build artifacts when available.

  5. Consider mirroring or vendoring the reviewed source or binary in a controlled registry to reduce reliance on a mutable external source.

  6. Run the CLI with least privilege and restrict its filesystem, credential, and network access to what is required for device control.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.