**Yes—there is meaningful security risk because Clawdline can read sensitive development data and enable remote control of your computer.** My limited review found useful safeguards, but it does not establish that v2.1.2 is safe to install.

The main risks are:

- **Sensitive information exposure.** It reads Claude/Codex conversations, terminal screens and project files used by its features. Credentials or customer data appearing there could become visible in the console. [Data-access disclosure](https://github.com/sainteye/clawdline/blob/239adc8ad4020f31509bff017bd4e5a3ff913197/README.md#security-and-your-data)
- **Remote execution through trusted devices.** Devices with operating permission can type into terminals and send agent instructions. A compromised paired browser could therefore affect your computer. Explicitly select read-only access; new Cloud devices without an existing pin default to operating scope. [Device permissions](https://github.com/sainteye/clawdline/blob/239adc8ad4020f31509bff017bd4e5a3ff913197/docs/cloud.md#per-browser-machine-grants)
- **Cloud endpoint trust.** Cloud is optional and documented as end-to-end encrypted, but your computer, paired browsers and the web application remain trusted endpoints. The private backend and production configuration cannot be verified from this repository. [Cloud trust boundary](https://github.com/sainteye/clawdline/blob/239adc8ad4020f31509bff017bd4e5a3ff913197/docs/cloud.md)

There are substantive protections: the installer verifies an Ed25519 signature using a pinned public key, then checks the archive’s size and SHA-256 **before extraction and execution**. The HTTP gate also checks authentication and applies origin and permission checks to changes. These reduce risk; signatures still require trusting the publisher and signing key. [Installer source](https://github.com/sainteye/clawdline/blob/239adc8ad4020f31509bff017bd4e5a3ff913197/install.sh), [HTTP gate](https://github.com/sainteye/clawdline/blob/239adc8ad4020f31509bff017bd4e5a3ff913197/internal/transport/http/gate.go)

**For v2.1.2 specifically:** GitHub associates the release with `239adc8`, but I could not retrieve its manifest or independently verify the downloaded binaries, attestations or notarization. Also, the README at that commit installs **v2.1.1**, so following it verbatim does not install your requested release. [Release](https://github.com/sainteye/clawdline/releases/tag/v2.1.2), [README installation steps](https://github.com/sainteye/clawdline/blob/239adc8ad4020f31509bff017bd4e5a3ff913197/README.md#install)

My recommendation: first try it under a separate OS account without production credentials, leave Cloud disabled initially, and use explicit read-only grants when remote viewing is needed. Before installing on a sensitive workstation, verify the v2.1.2 release evidence using the project’s [verification procedure](https://github.com/sainteye/clawdline/blob/239adc8ad4020f31509bff017bd4e5a3ff913197/docs/security/release-evidence.md#checking-a-release-yourself).

Fixed but not yet released (awaiting review): Nothing.