clavue-v1@1.48.1
Clavue v1: lightweight four-slot (main/light/plan/review) multi-model coding CLI on the execution-first engine — overlapped cross-family review, official Clavue cloud preset (api.clavue.com) alongside any Messages-compatible provider, learned context ceil
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe scanner’s credential-exfiltration hint resolves to bounded diagnostics reporting to the package’s own endpoint, with credential-pattern redaction and settings or environment controls. The other reviewed execution and dynamic-code findings support CLI jobs, schema serialization, and proxying; no confirmed attack surface remains.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A CLI error can invoke incident reporting when reporting has not been disabled; a requested Codex job invokes the job runner.
Impact
The diagnostic request may disclose error details and metadata such as the session identifier and current directory to the package service. No credential transfer or other concrete attack behavior was established.
Mechanism
Incident details are redacted and clipped before a POST to the package endpoint. Job execution runs the bundled Codex command with the job’s arguments.
AI rationale
The scanner’s credential-exfiltration hint resolves to bounded diagnostics reporting to the package’s own endpoint, with credential-pattern redaction and settings or environment controls. The other reviewed execution and dynamic-code findings support CLI jobs, schema serialization, and proxying; no confirmed attack surface remains.
Evidence
package.jsondist/provider-router.jsdist/mao-command.jsnode_modules/ajv/dist/compile/jtd/serialize.jsnode_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/http-proxy.js
Network endpoints1
api.clavue.com/v1/public/incidents
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/cli.js as the command entry point and has no install lifecycle hook.
- dist/provider-router.js redacts common credential formats and sends error reports to the package’s api.clavue.com endpoint only when incident reporting is enabled; environment or settings can disable it.
- dist/mao-command.js runs the bundled Codex command with job arguments as a runtime feature.
- AJV generates serializer code from schemas; the sandbox HTTP proxy checks CONNECT targets through a filter.
Evidence against
- Incident reports can include error details, session identifiers, and the current directory; reporting is enabled unless disabled by settings or environment.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
12 flagged · loading sourcedist/mao-command.jsView file
4var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO...
L5: GFS4: `),console.error(m)},"debug"));fs6[gracefulQueue]||(queue=global[gracefulQueue]||[],publishQueue(fs6,queue),fs6.close=(function(fs$close){function close(fd,cb){return fs$clos...
L6: `,"utf8"),process4.platform!=="win32")try{fs.chmodSync(filePath,384)}catch{}}__name(defaultWriteJsonFile,"defaultWriteJsonFile");function defaultSafeReadFile(filePath){try{return f...
High
Child Process
Package source references child process execution.
dist/mao-command.jsView on unpkg · L415${formatCommandFailure(result)}
L16: `}:{type:"text",value:renderJobResult2(completedJob)}}__name(runForegroundJob2,"runForegroundJob");function getStatusJobs2(cwd,limit=8,all=!1){let jobs=listEnrichedJobs(cwd);return...
L17: `,"utf8")}finally{try{await release()}catch{}}return filePath}__name(writeMaoCoordinationLedger,"writeMaoCoordinationLedger");async function acquireLedgerLock(filePath){try{await f...
High
node_modules/ajv/dist/compile/jtd/serialize.jsView file
Findings
1 Critical7 High7 Medium5 Low
CriticalCredential Exfiltrationdist/provider-router.js
HighChild Processdist/mao-command.js
HighShelldist/mao-command.js
HighEvalnode_modules/ajv/dist/compile/jtd/serialize.js
HighSame File Env Network Executiondist/provider-router.js
HighCommand Output Exfiltrationdist/provider-router.js
HighCloud Metadata Accessdist/provider-router.js
HighSemantic Analysis Limitednode_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/http-proxy.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarydist/vendor/ripgrep/x64-darwin/rg
MediumShips Build Helper
Affected versions and remediation
This report applies to clavue-v1@1.48.1.
See all versions of clavue-v1 for other recorded verdicts.
- Review the evidence and your use of clavue-v1@1.48.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.