I found no sign that this is malicious and no published advisories for it. The installer is better built than most `curl | sh` installers. But installing it does carry real risk, mostly because of what the tool is meant to do, not because of hidden behaviour. This review is based on docs and selected files, not a full code audit.

**What checks out**
- **Signed downloads:** `install.sh` at commit `fcc9059` checks the release manifest's Ed25519 signature against a key written into the script, using your local OpenSSL 3. Only after that does it check the archive's size and SHA-256, then unpack it and run it. It never skips verification if a check fails.
- **Matching keys:** the key in the installer (`2Du3yZ4j…/O0=`) is the same as the one in `internal/adapters/release/keys.go`.
- **Nothing unusual in the installer:** no `sudo`, no `eval`, no changes to your shell startup files, and no other remote scripts are run. It installs under `~/.local/share/clawdline-next`.
- **Release process:** releases can only be started by hand from `main`, they pass through a `release` environment that holds the signing secrets, and they're created as drafts first. The v2.1.3 tag points to `fcc9059`, the commit you linked.
- **No agent-targeted tricks:** `CLAUDE.md` and `AGENTS.md` are ordinary contributor guides with no hidden instructions aimed at AI agents.

**Risks to weigh**
1. **It's a remote-control tool by design.** It reads your Claude Code and Codex conversations, terminals and project files. Paired browsers or phones with "operating" permission can send instructions and use the terminal. Anyone who compromises a paired device, or the pairing step, effectively gets code execution on your machine.
2. **Cloud (optional, off by default):** content is end-to-end encrypted with AES-256-GCM and signed with Ed25519. But the Cloud service delivers the browser's JavaScript, so a compromised Cloud deployment could read your decrypted content. Cloud also sees metadata (account, devices, connection times, byte counts). Revoking a device doesn't take back anything it already read.
3. **The trust anchor is the installer itself.** The signature check is only as trustworthy as the copy of `install.sh` you run. The README pins it to a commit (`74fc07e`), which helps. The URL in the script's own header points to `main`, which can change, so don't use that one.
4. **Most of the setup isn't in the script.** Background services, tmux and the app are installed by the downloaded binary's `clawdline setup` command, and I didn't review that code.
5. **Release signing setup:** most GitHub Actions in the release workflow are pinned to version tags rather than exact commits. The macOS signing certificate and notary key are also exposed to the whole build step. Both are moderate supply-chain weaknesses.
6. **No independent security audit**, as the project states itself.

**What I couldn't verify**
- Whether the daemon on port 7727 listens only on your own machine (loopback) or on your network, and how its local API is authenticated.
- The v2.1.3 release files and checksums (the asset list didn't load), and the claim that the DMG is signed and notarized.
- That the GitHub approval gate on releases and the branch protection on `main` are actually turned on (both are repo settings, not visible in code).
- Which version the README's install command installs. The README at the v2.1.3 commit still pins v2.1.2. To get v2.1.3 you'd change `--version`, while keeping the reviewed script commit.
- The code for `setup`, the Cloud relay, pairing, and the web console, and the private Cloud service's infrastructure.

**Recommendation:** it's reasonable to install for local use if you accept that it reads and can act on your agent sessions. Use the pinned-commit install command, leave Cloud and direct mode off unless you need them, and pair only devices you control. Before trusting it on a shared network, run `lsof -iTCP:7727 -sTCP:LISTEN` after installing and confirm it shows `127.0.0.1`, not `*` or `0.0.0.0`.

Sources:
- [Repository at fcc9059](https://github.com/sainteye/clawdline/tree/fcc9059142485514d54683adb769710abb96e1ab)
- [Release v2.1.3](https://github.com/sainteye/clawdline/releases/tag/v2.1.3)
- [install.sh](https://raw.githubusercontent.com/sainteye/clawdline/fcc9059142485514d54683adb769710abb96e1ab/install.sh)
- [keys.go](https://raw.githubusercontent.com/sainteye/clawdline/fcc9059142485514d54683adb769710abb96e1ab/internal/adapters/release/keys.go)
- [release.yml](https://raw.githubusercontent.com/sainteye/clawdline/fcc9059142485514d54683adb769710abb96e1ab/.github/workflows/release.yml)
- [SECURITY.md](https://raw.githubusercontent.com/sainteye/clawdline/fcc9059142485514d54683adb769710abb96e1ab/SECURITY.md), [docs/security/README.md](https://raw.githubusercontent.com/sainteye/clawdline/fcc9059142485514d54683adb769710abb96e1ab/docs/security/README.md)
- [AGENTS.md](https://raw.githubusercontent.com/sainteye/clawdline/fcc9059142485514d54683adb769710abb96e1ab/AGENTS.md), [CLAUDE.md](https://raw.githubusercontent.com/sainteye/clawdline/fcc9059142485514d54683adb769710abb96e1ab/CLAUDE.md)
- [clawdline.com/security](https://clawdline.com/security/)
- Advisory searches returned only OpenClaw/Clawdbot, which is unrelated, e.g. [cve-dev.imfht.com](https://cve-dev.imfht.com/vendor/clawdbot?lang=en), [bitdoze.com](https://www.bitdoze.com/openclaw-security-guide/), [docs.openclaw.ai](https://docs.openclaw.ai/network)