中文 EN
Start Review
Skill Trust Decision

shieldcortex

合法的 AI Agent 记忆与安全工具，文档详尽透明，权限声明与实际行为一致，cloud sync 为 opt-in，仅传输元数据。存在轻微瑕疵：self-heal 机制可删除 ~/.clawdbot 目录（已声明可禁用），npx fallback 存在供应链风险（已建议安装本地 binary）。

Install decision first Source: ClawHub Scanned: 20 days ago
Files 10
Artifacts 9
Violations 0
Findings 3

Why this conclusion was reached

0/4 dimensions flagged
Pass
Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Review
Hidden execution and egress

9 lower-risk artifacts were extracted and still need context.

Pass
Attack chain and severe findings

There is no explicit malicious chain in the report.

Review
Dependencies and supply chain hygiene

4 dependency or supply-chain issues need attention.

What drove the risk score up

self-heal 可删除 ~/.clawdbot 目录 +8

handler.ts selfCheckAndHeal 递归删除 ~/.clawdbot/hooks/cortex-memory，但已声明且可通过 SHIELDCORTEX_SKIP_SELF_HEAL=1 禁用

npx -y fallback 供应链风险 +5

runtime.mjs resolveServerCmd 在未找到 binary 时 fallback 到 npx -y shieldcortex，npm 无版本锁定，但已文档声明并建议本地安装

文件访问范围宽泛 +5

声明的 paths_read 包含多个 agent 配置目录，但均用于安全扫描目的，行为与声明一致

网络连接声明完整 +2

网络端点均有文档声明，cloud sync 为 opt-in，敏感内容预览不外传

Most important evidence

Low Priv Escalation

Self-heal 机制可删除 ~/.clawdbot 目录

handler.ts selfCheckAndHeal 在首次 bootstrap 时递归删除 ~/.clawdbot/hooks/cortex-memory 和 ~/.clawdbot/hooks/internal/cortex-memory。如果 Claude Code 使用 .clawdbot 路径，此行为可能影响其功能。

bundled/cortex-memory-hook/handler.ts:620
已提供禁用选项：SHIELDCORTEX_SKIP_SELF_HEAL=1 或 shieldcortex config --self-heal false
Low Supply Chain

npx fallback 无版本锁定

runtime.mjs 在未找到本地 binary 时 fallback 到 `npx -y shieldcortex`，会从 npm registry 下载最新版本，存在供应链风险。

bundled/cortex-memory-hook/runtime.mjs:73
文档已建议全局安装 shieldcortex 或在 config.json 中设置 binaryPath
Info Sensitive Access

扫描多个 Agent 配置目录

paths_read 声明包含 ~/.claude/, ~/.cursor/, ~/.windsurf/, ~/.codex/ 等目录用于安全扫描，但仅读取 SKILL.md/HOOK.md 等指令文件。

SKILL.md:30
这是安全扫描的合法需求，行为与声明一致

Declared capability vs actual capability

Filesystem Pass
Declared WRITE
→
Inferred WRITE
SKILL.md 声明 filesystem:readwrite，代码在 ~/.shieldcortex/ 和 ~/.openclaw/ 目录写入
Network Pass
Declared optional
→
Inferred optional
cloud-sync.js 仅在 cfg.cloudEnabled 时发送元数据到 api.shieldcortex.ai
Shell Pass
Declared NONE
→
Inferred READ
runtime.mjs 使用 execFile (argv array) 而非 shell 调用，无注入风险
Environment Pass
Declared NONE
→
Inferred READ
读取 SHIELDCORTEX_CONFIG_DIR 等配置变量用于控制行为，无凭证收割

Suspicious artifacts and egress

Medium External URL
https://shieldcortex.ai

SKILL.md:12

Medium External URL
https://www.npmjs.com/package/shieldcortex

SKILL.md:13

Medium External URL
https://api.shieldcortex.ai

SKILL.md:61

Medium External URL
https://huggingface.co

SKILL.md:62

Medium External URL
https://shieldcortex.ai/docs

SKILL.md:318

Medium External URL
https://shieldcortex.ai/changelog

SKILL.md:322

Medium External URL
https://clawhub.ai/user/jarvis-drakon

skill-card.md:9

Medium External URL
https://clawhub.ai/jarvis-drakon/skills/shieldcortex

skill-card.md:46

Info Email
[email protected]

SKILL.md:296

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
better-sqlite3 * npm No 无版本锁定，但为本地数据库存储非网络依赖
express * npm No localhost:3001 本地 API 服务
ws * npm No localhost WebSocket 服务
@huggingface/transformers * npm No 可选依赖，从 huggingface.co 下载模型

File composition

10 files · 3314 lines
JavaScript 5 files · 1346 linesTypeScript 1 files · 1201 linesMarkdown 3 files · 562 linesJSON 1 files · 205 lines
Files of concern · 4
bundled/cortex-memory-hook/handler.ts TypeScript · 1201 lines
Self-heal 机制可删除 ~/.clawdbot 目录
SKILL.md Markdown · 328 lines
扫描多个 Agent 配置目录 · https://shieldcortex.ai · https://www.npmjs.com/package/shieldcortex · https://api.shieldcortex.ai · https://huggingface.co · https://shieldcortex.ai/docs · https://shieldcortex.ai/changelog · [email protected]
bundled/cortex-memory-hook/runtime.mjs JavaScript · 239 lines
npx fallback 无版本锁定
skill-card.md Markdown · 64 lines
https://clawhub.ai/user/jarvis-drakon · https://clawhub.ai/jarvis-drakon/skills/shieldcortex
Other files · index.js · interceptor.js · HOOK.md · openclaw.plugin.json · cloud-sync.js · intercept-ingest.js

Security positives

文档极其详尽透明，声明了所有特权操作及理由
cloud sync 强制 opt-in，且仅传输元数据不外传内容预览
subprocess 调用使用 argv array (execFile) 而非 shell，无命令注入风险
self-heal 机制有禁用选项 (SHIELDCORTEX_SKIP_SELF_HEAL)
无 eval/dynamic code execution
凭证模式写入时被防御管道拦截或隔离
代码开源 (MIT license)，npm audit 清洁
hasRecentMessages 仅读取最近 30 行，限制数据暴露
cloud-sync 明确删除 content/preview 字段后才发送