clavue-v1@1.8.0
Clavue v1: lightweight four-slot (main/light/plan/review) multi-model coding CLI on the execution-first engine — overlapped cross-family review, official Clavue cloud preset (api.clavue.com) alongside any Messages-compatible provider, learned context ceil
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe source confirms a user-triggered path that can send an existing membership credential to an unrestricted configured origin. Because the destination is operator-configurable and the default is the package’s router service, this supports a warning for conditional credential exposure rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user invokes router pull or load while a membership credential is available and CLAVUE_ROUTER_ORIGIN is set.
Impact
If the configured origin is unintended, the membership credential is disclosed to that recipient; the source does not show that this occurs with the default destination.
Mechanism
The CLI supplies the official profile credential to the router helper, which sends it as a Bearer token to the selected origin.
AI rationale
The source confirms a user-triggered path that can send an existing membership credential to an unrestricted configured origin. Because the destination is operator-configurable and the default is the package’s router service, this supports a warning for conditional credential exposure rather than a publish block.
Evidence
dist/cli.jsdist/provider-router.js
Network endpoints1
router.clavue.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes its CLI through dist/cli.js.
- The router origin can be set with CLAVUE_ROUTER_ORIGIN; otherwise it defaults to router.clavue.com.
- The router token resolver can use the supplied official membership credential.
- The CLI reads the credential from the official cloud profile and passes it to the router pull/load operation.
- The router request sends the token as a Bearer authorization value to the selected origin.
Evidence against
- The transfer runs when the user invokes router pull or load.
- The default destination is the package’s router service; the source does not establish that the configured override is hostile.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
12 flagged · loading sourcedist/mao-command.jsView file
4var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO...
L5: GFS4: `),console.error(m)},"debug"));fs6[gracefulQueue]||(queue=global[gracefulQueue]||[],publishQueue(fs6,queue),fs6.close=(function(fs$close){function close(fd,cb){return fs$clos...
L6: `,"utf8"),process4.platform!=="win32")try{fs.chmodSync(filePath,384)}catch{}}__name(defaultWriteJsonFile,"defaultWriteJsonFile");function defaultSafeReadFile(filePath){try{return f...
High
Child Process
Package source references child process execution.
dist/mao-command.jsView on unpkg · L4node_modules/@anthropic-ai/sandbox-runtime/dist/cli.jsView file
44.option('-s, --settings <path>', 'path to config file (default: ~/.srt-settings.json)')
L45: .option('-c <command>', 'run command string directly (like sh -c), no escaping applied')
L46: .option('--control-fd <fd>', 'read config updates from file descriptor (JSON lines protocol)', parseInt)
High
Shell
Package source references shell execution.
node_modules/@anthropic-ai/sandbox-runtime/dist/cli.jsView on unpkg · L44Findings
1 Critical6 High8 Medium5 Low
CriticalCredential Exfiltrationdist/provider-router.js
HighChild Processdist/mao-command.js
HighShellnode_modules/@anthropic-ai/sandbox-runtime/dist/cli.js
HighSame File Env Network Executiondist/provider-router.js
HighCommand Output Exfiltrationdist/provider-router.js
HighCloud Metadata Accessdist/provider-router.js
HighSemantic Analysis Limitednode_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/http-proxy.js#virtual:normalized:round1
MediumDynamic Requirenode_modules/@opentelemetry/api/build/src/metrics/NoopMeterProvider.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarydist/vendor/ripgrep/x64-darwin/rg
Affected versions and remediation
This report applies to clavue-v1@1.8.0.
See all versions of clavue-v1 for other recorded verdicts.
- Review the evidence and your use of clavue-v1@1.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.