LuLu CLI

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:10 AM UTC
• Version: 0.2.0

Overview

This skill is a legitimate LuLu firewall helper, but it gives an agent broad sudo authority to make persistent firewall changes through an unpinned third-party CLI.

Install only if you intentionally want an agent to administer LuLu firewall rules. Review every sudo lulu-cli command before it runs, avoid global allow-all rules for agent-reachable tools like node, python, curl, git, gh, or browser automation, and verify the Homebrew tap and installed binary before trusting it with root-level firewall changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12
• Finding: Unpinned Third-Party Homebrew Dependency May Enable Supply-Chain Compromise## Vulnerability Details **File Location**: `SKILL.md`, lines 12-19 **Vulnerability Type**: Unpinned third-party dependency from a mutable Homebrew tap **Risk Level**: Medium ```yaml requires: bins: ["lulu-cli"] install: - id: brew kind: brew formula: "woop/tap/lulu-cli" bins: ["lulu-cli"] label: "Install lulu-cli (brew)" ``` ### Technical Analysis The Skill delegates its firewall-management behavior to `lulu-cli`, which is installed from the third-party Homebrew tap `woop/tap`. The dependency declaration does not constrain the package to an immutable version, source commit, or cryptographic checksum. Consequently, the executable installed under the expected `lulu-cli` name can change after this Skill has been reviewed. The project does not include the dependency's implementation, so its effective behavior cannot be verified from the audited files. If the tap, formula, upstream release infrastructure, or maintainer account were compromised, a modified executable could be distributed without requiring changes to this Skill. This risk is amplified because the documented workflow invokes the dependency through `sudo` for rule modifications and system-extension reloads. The finding does not establish that the current package is malicious; it identifies an inadequately constrained trust boundary that could permit a supply-chain compromise. ### Attack Path 1. An attacker compromises the third-party Homebrew tap, its maintainer account, the referenced upstream artifact, or another part of its release pipeline. 2. The attacker modifies the formula or distributed package so that it installs a malicious executable named `lulu-cli`. 3. A user or Agent installs the dependency through the Skill's installation metadata. 4. The Agent follows the documented workflow and executes a command such as `sudo lulu-cli add ...` or `sudo lulu-cli reload`. 5. The substituted executable runs attacker-controlled logic ...[truncated 800 chars]
• Remediation: ## Remediation Suggestions 1. Prefer a verified official distribution channel maintained by the LuLu or `lulu-cli` project. 2. Pin the dependency to a specific immutable release or source commit rather than tracking a mutable formula. 3. Verify downloaded artifacts using a documented cryptographic checksum or signature before installation. 4. Record the authoritative source repository and expected publisher identity in the Skill metadata or documentation. 5. Audit the dependency's source and Homebrew formula, including installation hooks, before allowing privileged execution. 6. Where supported, verify the installed executable's code signature, hash, ownership, and path before invoking it with `sudo`. 7. Minimize privileged use by separating read-only operations from narrowly scoped write operations and avoiding unrestricted root execution where a purpose-built privileged helper or explicit authorization policy is available. 8. Establish a dependency-update review process so that version or checksum changes require renewed security assessment.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (28)

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger list includes broad natural-language phrases like "allow domain," "firewall rules," "check blocks," and "unblock," which can cause the skill to activate in routine troubleshooting contexts. Because this skill authorizes privileged firewall modification, unintended invocation increases the chance an agent will make security-sensitive changes without sufficiently explicit user intent.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Prevents data exfiltration while allowing essential services. Triggers include
  "connection blocked", "allow domain", "firewall rules", "check blocks",
  "lulu", "unblock".
allowed-tools: Bash(lulu-cli:*), Bash(sudo lulu-cli:*)
metadata:
  openclaw:
    os: ["darwin"]

• Confidence: 98% confidence
• Finding: The skill explicitly permits `Bash(sudo lulu-cli:*)`, granting root-capable firewall administration from the agent. This is dangerous because an agent that can run arbitrary sudo-backed `lulu-cli` subcommands can weaken or disable outbound controls, create overly broad allow rules, or interrupt filtering via reloads, undermining the firewall as a containment boundary.

Session Persistence

Medium

• Category: Rogue Agent

Content

LuLu runs as a macOS system extension. When configured in **passive mode** with new connections defaulting to block, any unrecognized outbound connection is silently blocked and logged as a passive rule.

- Rules live in `/Library/Objective-See/LuLu/rules.plist` (NSKeyedArchiver binary format, owned by root)
- The CLI reads/writes this file directly using the same serialization format as LuLu
- The system extension only reads rules at startup, so `reload` (kill + auto-restart) is needed after changes
- New blocks from passive mode appear immediately in `recent` without needing a reload

• Confidence: 91% confidence
• Finding: The skill manages persistent firewall rules by directly reading and writing the root-owned `/Library/Objective-See/LuLu/rules.plist`, causing changes to survive across sessions and reboots. In the context of an agent security boundary, persistence is especially dangerous because a mistaken or malicious allow rule can permanently weaken outbound restrictions and enable future data exfiltration without renewed user intent.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

List all firewall rules. Optionally filter by keyword (matches against key and binary path, case-insensitive).

- No sudo required
- Output: `[key]` header, then one line per rule showing UUID, action, addr, port, type, and status

**Examples:**

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

List all firewall rules. Optionally filter by keyword (matches against key and binary path, case-insensitive).

- No sudo required
- Output: `[key]` header, then one line per rule showing UUID, action, addr, port, type, and status

**Examples:**

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

List all firewall rules. Optionally filter by keyword (matches against key and binary path, case-insensitive).

- No sudo required
- Output: `[key]` header, then one line per rule showing UUID, action, addr, port, type, and status

**Examples:**

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

List all firewall rules. Optionally filter by keyword (matches against key and binary path, case-insensitive).

- No sudo required
- Output: `[key]` header, then one line per rule showing UUID, action, addr, port, type, and status

**Examples:**

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

List all firewall rules. Optionally filter by keyword (matches against key and binary path, case-insensitive).

- No sudo required
- Output: `[key]` header, then one line per rule showing UUID, action, addr, port, type, and status

**Examples:**

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

List all firewall rules. Optionally filter by keyword (matches against key and binary path, case-insensitive).

- No sudo required
- Output: `[key]` header, then one line per rule showing UUID, action, addr, port, type, and status

**Examples:**

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

List all firewall rules. Optionally filter by keyword (matches against key and binary path, case-insensitive).

- No sudo required
- Output: `[key]` header, then one line per rule showing UUID, action, addr, port, type, and status

**Examples:**

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

List all firewall rules. Optionally filter by keyword (matches against key and binary path, case-insensitive).

- No sudo required
- Output: `[key]` header, then one line per rule showing UUID, action, addr, port, type, and status

**Examples:**

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Examples:**
```bash
# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Examples:**
```bash
# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Examples:**
```bash
# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Examples:**
```bash
# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Examples:**
```bash
# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Examples:**
```bash
# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Examples:**
```bash
# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Examples:**
```bash
# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Examples:**
```bash
# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Examples:**
```bash
# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Examples:**
```bash
# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Examples:**
```bash
# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Examples:**
```bash
# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Examples:**
```bash
# Allow a domain for all apps
sudo lulu-cli add --key '*' --path '*' --action allow --addr example.com --port 443

# Allow domain + all subdomains via regex
sudo lulu-cli add --key '*' --path '*' --action allow \

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.