clavue-v1@1.42.4
Clavue v1: lightweight four-slot (main/light/plan/review) multi-model coding CLI on the execution-first engine — overlapped cross-family review, official Clavue cloud preset (api.clavue.com) alongside any Messages-compatible provider, learned context ceil
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest has no install hook, and the flagged runtime primitives have ordinary package functions. The default-on diagnostics upload merits awareness, but its first-party destination, configurable opt-out, and inspected payload do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A CLI error or interrupt can trigger diagnostics reporting during runtime.
Impact
The report may disclose client metadata and error details to the package’s own service, but the inspected code does not establish credential theft or another concrete attack.
Mechanism
The reporter saves a record locally and may POST redacted error and client details to api.clavue.com; the upload can be disabled through settings or environment configuration.
AI rationale
The manifest has no install hook, and the flagged runtime primitives have ordinary package functions. The default-on diagnostics upload merits awareness, but its first-party destination, configurable opt-out, and inspected payload do not establish malicious behavior.
Network endpoints1
api.clavue.com/v1/public/incidents
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares a CLI entry point and its scripts contain repository build and check tasks, with no install lifecycle hook.
- The diagnostics uploader honors an explicit opt-out and a settings value; its setting description explains that reports include client details.
- Error reports contain the error message and stack, while the source redacts common bearer tokens, API keys, and secret-like values. The upload defaults to Clavue’s own API.
- The flagged dynamic function construction is used by Ajv to build serializers; the sandbox proxy and Mao command runner use network proxying and child processes for their stated runtime functions.
Evidence against
- Diagnostics upload is enabled when unset and can include client details such as the working directory and configured model. This is a privacy consideration, but the inspected source sends it to the package’s own diagnostics endpoint and does not establish credential exfiltration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEval
Source & flagged code
12 flagged · loading sourcedist/mao-command.jsView file
4var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO...
L5: GFS4: `),console.error(m)},"debug"));fs6[gracefulQueue]||(queue=global[gracefulQueue]||[],publishQueue(fs6,queue),fs6.close=(function(fs$close){function close(fd,cb){return fs$clos...
L6: `,"utf8"),process4.platform!=="win32")try{fs.chmodSync(filePath,384)}catch{}}__name(defaultWriteJsonFile,"defaultWriteJsonFile");function defaultSafeReadFile(filePath){try{return f...
High
Child Process
Package source references child process execution.
dist/mao-command.jsView on unpkg · L415${formatCommandFailure(result)}
L16: `}:{type:"text",value:renderJobResult2(completedJob)}}__name(runForegroundJob2,"runForegroundJob");function getStatusJobs2(cwd,limit=8,all=!1){let jobs=listEnrichedJobs(cwd);return...
L17: `,"utf8")}finally{try{await release()}catch{}}return filePath}__name(writeMaoCoordinationLedger,"writeMaoCoordinationLedger");async function acquireLedgerLock(filePath){try{await f...
High
node_modules/ajv/dist/compile/jtd/serialize.jsView file
Findings
1 Critical7 High7 Medium5 Low
CriticalCredential Exfiltrationdist/provider-router.js
HighChild Processdist/mao-command.js
HighShelldist/mao-command.js
HighEvalnode_modules/ajv/dist/compile/jtd/serialize.js
HighSame File Env Network Executiondist/provider-router.js
HighCommand Output Exfiltrationdist/provider-router.js
HighCloud Metadata Accessdist/provider-router.js
HighSemantic Analysis Limitednode_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/http-proxy.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarynode_modules/@anthropic-ai/sandbox-runtime/dist/vendor/seccomp/x64/apply-seccomp
Affected versions and remediation
This report applies to clavue-v1@1.42.4.
See all versions of clavue-v1 for other recorded verdicts.
- Review the evidence and your use of clavue-v1@1.42.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.