registry / clavue-v1 / 1.11.0

clavue-v1@1.11.0

Clavue v1: lightweight four-slot (main/light/plan/review) multi-model coding CLI on the execution-first engine — overlapped cross-family review, official Clavue cloud preset (api.clavue.com) alongside any Messages-compatible provider, learned context ceil

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The package has no install lifecycle hook or runtime self-dependency, and the inspected credential and command-execution matches fit provider and CLI behavior. No concrete attack was established.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user invokes the CLI or a runtime command.

Impact

No malicious effect was identified.

Mechanism

Provider requests use configured provider inputs; sandboxed connections are checked by a policy filter.

AI rationale

The package has no install lifecycle hook or runtime self-dependency, and the inspected credential and command-execution matches fit provider and CLI behavior. No concrete attack was established.

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes a CLI and defines no install lifecycle hook or runtime self-dependency.
The provider catalog helper uses its supplied base URL and credential for a model-catalog request; it excludes the official Clavue host.
The Responses adapter translates request fields and disables response storage.
The Mao command runner launches commands at runtime; the sandbox CLI wraps requested commands, and the HTTP proxy checks policy before allowing connections.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 7 file(s), 4.42 MB of source, external domains: 1.1.1.1, 169.254.169.254, api-staging.anthropic.com, api.anthropic.com, api.kimi.com, api.minimaxi.com, beacon.claude-ai.staging.ant.dev, claude-ai.staging.ant.dev, claude-staging.fedstart.com, claude.ai, claude.com, claude.fedstart.com, git-scm.com, github.com, json-schema.org, json.schemastore.org, mcp-proxy-staging.anthropic.com, mcp-proxy.anthropic.com, metadata.google.internal, oauth2.googleapis.com, open.bigmodel.cn, openrouter.ai, platform.claude.com, platform.staging.ant.dev

Source & flagged code

12 flagged

dist/mao-command.jsView file

4var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L5: GFS4: `),console.error(m)},"debug"));fs6[gracefulQueue]||(queue=global[gracefulQueue]||[],publishQueue(fs6,queue),fs6.close=(function(fs$close){function close(fd,cb){return fs$clos... L6: `,"utf8"),process4.platform!=="win32")try{fs.chmodSync(filePath,384)}catch{}}__name(defaultWriteJsonFile,"defaultWriteJsonFile");function defaultSafeReadFile(filePath){try{return f...

High

Child Process

Package source references child process execution.

dist/mao-command.jsView on unpkg · L4

node_modules/@anthropic-ai/sandbox-runtime/dist/cli.jsView file

44.option('-s, --settings <path>', 'path to config file (default: ~/.srt-settings.json)') L45: .option('-c <command>', 'run command string directly (like sh -c), no escaping applied') L46: .option('--control-fd <fd>', 'read config updates from file descriptor (JSON lines protocol)', parseInt)

High

Shell

Package source references shell execution.

node_modules/@anthropic-ai/sandbox-runtime/dist/cli.jsView on unpkg · L44

node_modules/@opentelemetry/api/build/src/metrics/NoopMeterProvider.jsView file

7exports.NOOP_METER_PROVIDER = exports.NoopMeterProvider = void 0; L8: const NoopMeter_1 = require("./NoopMeter"); L9: /**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

node_modules/@opentelemetry/api/build/src/metrics/NoopMeterProvider.jsView on unpkg · L7

dist/provider-router.jsView file

3// clavue v1.11.0 provider-router (built from source) L4: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L5: `?(templateIndex-=1,rawIndex+=1):nextRawCharacter==="u"&&rawTemplate[rawIndex+2]==="{"?rawIndex=rawTemplate.indexOf("}",rawIndex+3):rawIndex+=ESCAPE_LENGTH[nextRawCharacter]??1}}le... L6: `]),ESCAPE_LENGTH={x:3,u:5},concatTokens=__name((tokens,nextTokens,isSeparated)=>isSeparated||tokens.length===0||nextTokens.length===0?[...tokens,...nextTokens]:[...tokens.slice(0,... L7: It must be "${optionName}.stdout", "${optionName}.stderr", "${optionName}.all", "${optionName}.ipc", or "${optionName}.fd3", "${optionName}.fd4" (and so on).`);if(fdNumber>=o

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/provider-router.jsView on unpkg · L3

32${originalMessage}`}return cwdStat.isDirectory()?originalMessage:`The "cwd" option is not a directory: ${cwd2}. L33: ${originalMessage}`},"fixCwdError")}});import path5 from"node:path";import process6 from"node:process";var import_cross_spawn,normalizeOptions,addDefaultOptions,getEnv,init_options... L34: `,LF_BINARY=LF.codePointAt(0),CR="\r",CR_BINARY=CR.codePointAt(0)}});function isStream(stream4,{checkOpen=!0}={}){return stream4!==null&&typeof stream4=="object"&&(stream4.writable... ... L45: Instead, \`yield\` should either be called with a value, or not be called at all. For example: L46: if (condition) { yield value; }`)},"validateEmptyReturn")}});import{Buffer as Buffer3}from"node:buffer";import{StringDecoder as StringDecoder2}from"node:string_decoder";var getEnco... L47: `):[]}}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/provider-router.jsView on unpkg · L32

dist/vendor/ripgrep/x64-darwin/rgView file

•path = dist/vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4442900 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/ripgrep/x64-darwin/rgView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1668 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 14605507 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 14605507 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/http-proxy.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 16

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/http-proxy.js#virtual:normalized:round1View on unpkg

Source & flagged code

12 flagged · loading source

dist/mao-command.jsView file

High

Child Process

Package source references child process execution.

dist/mao-command.jsView on unpkg · L4

node_modules/@anthropic-ai/sandbox-runtime/dist/cli.jsView file

High

Shell

Package source references shell execution.

node_modules/@anthropic-ai/sandbox-runtime/dist/cli.jsView on unpkg · L44

Findings

1 Critical6 High8 Medium5 Low

CriticalCredential Exfiltrationdist/provider-router.js

HighChild Processdist/mao-command.js

HighShellnode_modules/@anthropic-ai/sandbox-runtime/dist/cli.js

HighSame File Env Network Executiondist/provider-router.js

HighCommand Output Exfiltrationdist/provider-router.js

HighCloud Metadata Accessdist/provider-router.js

HighSemantic Analysis Limitednode_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/http-proxy.js#virtual:normalized:round1

MediumDynamic Requirenode_modules/@opentelemetry/api/build/src/metrics/NoopMeterProvider.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarydist/vendor/ripgrep/x64-darwin/rg

Affected versions and remediation

This report applies to clavue-v1@1.11.0.

See all versions of clavue-v1 for other recorded verdicts.

Review the evidence and your use of clavue-v1@1.11.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 23:53:01.786Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code