Blucli

PassAudited by ClawScan on May 1, 2026.

Overview

This skill clearly documents a BluOS command-line tool for controlling speakers, with no evidence of hidden or unrelated behavior.

This appears safe for its stated purpose. Before installing, make sure you trust the external blucli Go module, and when using it, confirm the target BluOS device before changing playback, grouping, or volume.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent may control speaker playback or volume if invoked for those tasks.

Why it was flagged

The documented commands can alter playback, grouping, and volume on BluOS devices, which is expected for this skill but still affects real devices.

Skill content

Common tasks
- Grouping: `blu group status|add|remove`
...
- `blu play|pause|stop`
- `blu volume set 15`

Recommendation

Confirm the intended device and action before allowing playback, grouping, or volume changes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Future installs could retrieve a different version of the external CLI than the one the publisher intended.

Why it was flagged

The install uses an external Go module with the floating @latest version, meaning the exact installed code may change over time.

Skill content

go | module: github.com/steipete/blucli/cmd/blu@latest | creates binaries: blu

Recommendation

Prefer a pinned module version if reproducibility is important, and install only if you trust the upstream blucli project.