LuLu CLI

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:10 AM UTC
• Version: 0.2.0

Overview

This skill is a legitimate LuLu firewall helper, but it gives an agent broad sudo authority to make persistent firewall changes through an unpinned third-party CLI.

Install only if you intentionally want an agent to administer LuLu firewall rules. Review every sudo lulu-cli command before it runs, avoid global allow-all rules for agent-reachable tools like node, python, curl, git, gh, or browser automation, and verify the Homebrew tap and installed binary before trusting it with root-level firewall changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party Homebrew Dependency May Enable Supply-Chain Compromise

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-19
Vulnerability Type: Unpinned third-party dependency from a mutable Homebrew tap
Risk Level: Medium

yaml

requires:
  bins: ["lulu-cli"]
install:
  - id: brew
    kind: brew
    formula: "woop/tap/lulu-cli"
    bins: ["lulu-cli"]
    label: "Install lulu-cli (brew)"

Technical Analysis

The Skill delegates its firewall-management behavior to lulu-cli, which is installed from the third-party Homebrew tap woop/tap. The dependency declaration does not constrain the package to an immutable version, source commit, or cryptographic checksum.

Consequently, the executable installed under the expected lulu-cli name can change after this Skill has been reviewed. The project does not include the dependency's implementation, so its effective behavior cannot be verified from the audited files. If the tap, formula, upstream release infrastructure, or maintainer account were compromised, a modified executable could be distributed without requiring changes to this Skill.

This risk is amplified because the documented workflow invokes the dependency through sudo for rule modifications and system-extension reloads. The finding does not establish that the current package is malicious; it identifies an inadequately constrained trust boundary that could permit a supply-chain compromise.

Attack Path

1. An attacker compromises the third-party Homebrew tap, its maintainer account, the referenced upstream artifact, or another part of its release pipeline.
2. The attacker modifies the formula or distributed package so that it installs a malicious executable named lulu-cli.
3. A user or Agent installs the dependency through the Skill's installation metadata.
4. The Agent follows the documented workflow and executes a command such as sudo lulu-cli add ... or sudo lulu-cli reload.
5. The substituted executable runs attacker-controlled logic ...[truncated 800 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer a verified official distribution channel maintained by the LuLu or lulu-cli project.
2. Pin the dependency to a specific immutable release or source commit rather than tracking a mutable formula.
3. Verify downloaded artifacts using a documented cryptographic checksum or signature before installation.
4. Record the authoritative source repository and expected publisher identity in the Skill metadata or documentation.
5. Audit the dependency's source and Homebrew formula, including installation hooks, before allowing privileged execution.
6. Where supported, verify the installed executable's code signature, hash, ownership, and path before invoking it with sudo.
7. Minimize privileged use by separating read-only operations from narrowly scoped write operations and avoiding unrestricted root execution where a purpose-built privileged helper or explicit authorization policy is available.
8. Establish a dependency-update review process so that version or checksum changes require renewed security assessment.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (28)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list includes broad natural-language phrases like "allow domain," "firewall rules," "check blocks," and "unblock," which can cause the skill to activate in routine troubleshooting contexts. Because this skill authorizes privileged firewall modification, unintended invocation increases the chance an agent will make security-sensitive changes without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill explicitly permits Bash(sudo lulu-cli:*), granting root-capable firewall administration from the agent. This is dangerous because an agent that can run arbitrary sudo-backed lulu-cli subcommands can weaken or disable outbound controls, create overly broad allow rules, or interrupt filtering via reloads, undermining the firewall as a containment boundary.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

Prevents data exfiltration while allowing essential services. Triggers include
  "connection blocked", "allow domain", "firewall rules", "check blocks",
  "lulu", "unblock".
allowed-tools: Bash(lulu-cli:*), Bash(sudo lulu-cli:*)
metadata:
  openclaw:
    os: ["darwin"]

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill manages persistent firewall rules by directly reading and writing the root-owned /Library/Objective-See/LuLu/rules.plist, causing changes to survive across sessions and reboots. In the context of an agent security boundary, persistence is especially dangerous because a mistaken or malicious allow rule can permanently weaken outbound restrictions and enable future data exfiltration without renewed user intent.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

LuLu runs as a macOS system extension. When configured in **passive mode** with new connections defaulting to block, any unrecognized outbound connection is silently blocked and logged as a passive rule.

- Rules live in `/Library/Objective-See/LuLu/rules.plist` (NSKeyedArchiver binary format, owned by root)
- The CLI reads/writes this file directly using the same serialization format as LuLu
- The system extension only reads rules at startup, so `reload` (kill + auto-restart) is needed after changes
- New blocks from passive mode appear immediately in `recent` without needing a reload

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

List all firewall rules. Optionally filter by keyword (matches against key and binary path, case-insensitive).

- No sudo required
- Output: `[key]` header, then one line per rule showing UUID, action, addr, port, type, and status

**Examples:**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

List all firewall rules. Optionally filter by keyword (matches against key and binary path, case-insensitive).

- No sudo required
- Output: `[key]` header, then one line per rule showing UUID, action, addr, port, type, and status

**Examples:**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

List all firewall rules. Optionally filter by keyword (matches against key and binary path, case-insensitive).

- No sudo required
- Output: `[key]` header, then one line per rule showing UUID, action, addr, port, type, and status

**Examples:**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

md

List all firewall rules. Optionally filter by keyword (matches against key and binary path, case-insensitive).

- No sudo required
- Output: `[key]` header, then one line per rule showing UUID, action, addr, port, type, and status

**Examples:**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/commands.md (reported line 7)May include surrounding context.

md

List all firewall rules. Optionally filter by keyword (matches against key and binary path, case-insensitive).

- No sudo required
- Output: `[key]` header, then one line per rule showing UUID, action, addr, port, type, and status

**Examples:**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/commands.md (reported line 22)May include surrounding context.

md

List all firewall rules. Optionally filter by keyword (matches against key and binary path, case-insensitive).

- No sudo required
- Output: `[key]` header, then one line per rule showing UUID, action, addr, port, type, and status

**Examples:**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/commands.md (reported line 54)May include surrounding context.

md

List all firewall rules. Optionally filter by keyword (matches against key and binary path, case-insensitive).

- No sudo required
- Output: `[key]` header, then one line per rule showing UUID, action, addr, port, type, and status

**Examples:**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/commands.md (reported line 58)May include surrounding context.

md

List all firewall rules. Optionally filter by keyword (matches against key and binary path, case-insensitive).

- No sudo required
- Output: `[key]` header, then one line per rule showing UUID, action, addr, port, type, and status

**Examples:**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

Examples:

bash

# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

Examples:

bash

# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

Examples:

bash

# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

Examples:

bash

# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

Examples:

bash

# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

Examples:

bash

# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

Examples:

bash

# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

Examples:

bash

# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

Examples:

bash

# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

Examples:

bash

# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

Examples:

bash

# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/commands.md (reported line 51)May include surrounding context.

Examples:

bash

# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/commands.md (reported line 62)May include surrounding context.

Examples:

bash

# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/commands.md (reported line 80)May include surrounding context.

Examples:

bash

# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \