I must clarify that I don't have any reasons to doubt about Clamclient's source code, It have been reviewed by dooglus and many others in the community and has enough time around for someone to point anything that doesn't looks right, anyone that has the ability can review it.
I would also point out that I have claimed CLAMs from some old very well funded Bitcoin addresses without moving the bitcoins out of them first, and the coins were never stolen from those addresses.
I couldn't be more confident that CLAM isn't a scam intended to steal Bitcoin private keys.