ClawHub
Back to skill

Security audit

ShieldCortex

Security checks for vulnerabilities and agentic risk

Overview

ShieldCortex appears to be a legitimate memory and security tool, but it requests unusually broad agent, transcript, config, hook, and update authority that users should review carefully before installing.

Install only if you want a persistent local agent-memory and security layer with access to agent configs, MCP settings, rule files, .env scans, and optional transcript-derived memories. Prefer a reviewed, locally installed/pinned shieldcortex binary over npx fallback, disable self-heal if you do not want automatic hook writes, keep Cloud sync and webhooks off unless needed, and review or disable auto-memory on sensitive projects.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Findings (43)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
- $CWD/.claude/, $CWD/.cursor/ (project-level configs)
    - $CWD/.cursorrules, $CWD/.windsurfrules, $CWD/.clinerules
    - $CWD/CLAUDE.md, $CWD/copilot-instructions.md
    - $CWD/.aider.conf.yml, $CWD/.continue/config.json
    - $CWD/.env (env-scanner checks for leaked secrets — reads, never writes)
  paths_write:
    - ~/.shieldcortex/ (memory DB, config, cortex log, licence, audit cache)

Credential Access

High
Category
Privilege Escalation
Confidence
81% confidence
Finding

Reading .env files to scan for leaked credentials is highly sensitive because those files often contain live secrets. Even if described as read-only, this materially increases exposure: a bug, compromise, overbroad logging, or memory capture path could disclose credentials from one of the most sensitive files in a project.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
- $CWD/.cursorrules, $CWD/.windsurfrules, $CWD/.clinerules
    - $CWD/CLAUDE.md, $CWD/copilot-instructions.md
    - $CWD/.aider.conf.yml, $CWD/.continue/config.json
    - $CWD/.env (env-scanner checks for leaked secrets — reads, never writes)
  paths_write:
    - ~/.shieldcortex/ (memory DB, config, cortex log, licence, audit cache)
    - ~/.cache/shieldcortex/models (embedding model download cache)

MCP Config Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md
- ~/.shieldcortex/ (memory DB, config, cortex log, licence, audit cache)
    - ~/.cache/shieldcortex/models (embedding model download cache)
    - ~/.openclaw/extensions/shieldcortex-realtime/ (OpenClaw plugin via the wrapper install only; native `openclaw plugins install` uses OpenClaw's managed npm tree instead)
    - ~/.claude/mcp.json, ~/.cursor/mcp.json (MCP server registration, when user runs setup)
  network_endpoints:
    - https://api.shieldcortex.ai (Cloud sync + audit telemetry — only when Cloud sync is enabled; licence validation — only when a licence key is activated, fired at CLI `license activate` and the dashboard's activation call (POST /api/license/activate), with no periodic or background re-check; sends the subscription id, works with Cloud sync off; never called when no key is configured)
    - https://huggingface.co (embedding-model download — Xenova/all-MiniLM-L6-v2, ~90 MB, fetched into ~/.cache/shieldcortex/models by the MCP server's background preload at startup or the first operation needing an embedding, whenever the model is not already cached, plus one re-download if a cached copy is detected corrupt; SHIELDCORTEX_SKIP_EMBEDDINGS=1 prevents it. The optional Local AI Explainer model downloads from the same host only on explicit, consent-prompted `review-copilot enable`/`download-model` — its review runs use the local cache only)

MCP Config Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 283)May include surrounding context.

md
- ~/.shieldcortex/ (memory DB, config, cortex log, licence, audit cache)
    - ~/.cache/shieldcortex/models (embedding model download cache)
    - ~/.openclaw/extensions/shieldcortex-realtime/ (OpenClaw plugin via the wrapper install only; native `openclaw plugins install` uses OpenClaw's managed npm tree instead)
    - ~/.claude/mcp.json, ~/.cursor/mcp.json (MCP server registration, when user runs setup)
  network_endpoints:
    - https://api.shieldcortex.ai (Cloud sync + audit telemetry — only when Cloud sync is enabled; licence validation — only when a licence key is activated, fired at CLI `license activate` and the dashboard's activation call (POST /api/license/activate), with no periodic or background re-check; sends the subscription id, works with Cloud sync off; never called when no key is configured)
    - https://huggingface.co (embedding-model download — Xenova/all-MiniLM-L6-v2, ~90 MB, fetched into ~/.cache/shieldcortex/models by the MCP server's background preload at startup or the first operation needing an embedding, whenever the model is not already cached, plus one re-download if a cached copy is detected corrupt; SHIELDCORTEX_SKIP_EMBEDDINGS=1 prevents it. The optional Local AI Explainer model downloads from the same host only on explicit, consent-prompted `review-copilot enable`/`download-model` — its review runs use the local cache only)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md
- **Active interception, not scan-only — on hosts that can deny.** Writes failing the pipeline are quarantined/blocked; recalled memory is trust/ACL-filtered before the agent sees it. Tool-call denial is **bound** on Claude Code (PreToolUse), OpenClaw (`before_tool_call`), and Hermes (`pre_tool_call`, enforce by default). Codex, Cursor, Copilot, and generic MCP get a memory server / scanner the model may ignore — they are **not bound**. Tool-output firewall defaults to advisory. `shieldcortex doctor` and `shieldcortex lease` report bound / not-bound / unknown per plane.
- **Setup is user-initiated, with one bounded exception.** Installing hooks, registering the MCP server, and migrating data are manual steps the user runs in their terminal, and bare `quickstart` / `setup` asks before each action; a named host, as in `setup claude`, is wired without asking. The npm postinstall script (disclosed in the trust table above) never adds integrations that weren't already present — on global installs it only prints instructions, checks the native binding, seeds default config on first install, and refreshes an existing OpenClaw hook/plugin install. The exception: the bundled cortex-memory hook performs a small automatic self-heal at gateway bootstrap, documented in full under **"Automatic self-heal at gateway bootstrap"** below.
- **Setup migrates legacy data.** The first `quickstart`/`setup` run may move or remove legacy config/memory directories (e.g. `~/.claude-cortex/`, `~/.claude-memory/`) into `~/.shieldcortex/` and copy hook files into place. This happens only on the user-run setup command — never on `npm install` (the postinstall script does not touch memory or config data beyond seeding defaults on a first-ever global install).
- **Destructive `forget` is bounded and gated.** Per-memory and filtered bulk deletes go through a delete ACL (own-only) and are recorded in the audit ledger. Revoke-by-source (`forget --fromSource`, bulk-delete every memory from one source —
...[truncated 26 chars]

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
- **First-use model download (huggingface.co).** Semantic memory runs a local embedding model (Xenova/all-MiniLM-L6-v2, ~90 MB ONNX) that is **not bundled** with the package. Whenever it is missing from `~/.cache/shieldcortex/models`, the MCP server downloads it from huggingface.co — triggered by the background preload at server start, or by the first operation that needs an embedding, plus a single re-download if a cached copy is detected corrupt. This is the one network call that is not user-initiated. Avoid it with `SHIELDCORTEX_SKIP_EMBEDDINGS=1` (memory falls back to full-text search) or by pre-seeding the model cache. The optional Local AI Explainer (`review-copilot`) downloads its model from the same host only on an explicit, consent-prompted `enable`/`download-model` command; its review runs never fetch remotely.
- **Network is off by default, with the first-run exception above.** With no licence key activated, no Cloud sync enabled, and no webhooks configured, ShieldCortex's only outbound connections are the embedding-model download just described (fires on server start when the model is not cached) and one further caveat: the OpenClaw hook's `npx -y shieldcortex` fallback downloads the package on first use when ShieldCortex is not installed locally — see `network_endpoints`. Every other entry in `network_endpoints` is user-initiated: Cloud sync (opt-in), licence-key validation when you activate a key (at CLI or dashboard activation only, no background re-check — works even with Cloud sync off), npm-registry update checks/updates (dashboard buttons or `shieldcortex update`), X-Ray package lookups (`shieldcortex xray` or the dashboard X-Ray page, tarball download with `--deep`), URLs you pass to `env scan`, and webhooks you configure (memory events and Iron Dome operator notifications). The dashboard binds to localhost by default but may be explicitly exposed with `SHIELDCORTEX_HOST`; when exposed, the loopback session-token endpoint stays disabled. The work
...[truncated 25 chars]

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md
- **First-use model download (huggingface.co).** Semantic memory runs a local embedding model (Xenova/all-MiniLM-L6-v2, ~90 MB ONNX) that is **not bundled** with the package. Whenever it is missing from `~/.cache/shieldcortex/models`, the MCP server downloads it from huggingface.co — triggered by the background preload at server start, or by the first operation that needs an embedding, plus a single re-download if a cached copy is detected corrupt. This is the one network call that is not user-initiated. Avoid it with `SHIELDCORTEX_SKIP_EMBEDDINGS=1` (memory falls back to full-text search) or by pre-seeding the model cache. The optional Local AI Explainer (`review-copilot`) downloads its model from the same host only on an explicit, consent-prompted `enable`/`download-model` command; its review runs never fetch remotely.
- **Network is off by default, with the first-run exception above.** With no licence key activated, no Cloud sync enabled, and no webhooks configured, ShieldCortex's only outbound connections are the embedding-model download just described (fires on server start when the model is not cached) and one further caveat: the OpenClaw hook's `npx -y shieldcortex` fallback downloads the package on first use when ShieldCortex is not installed locally — see `network_endpoints`. Every other entry in `network_endpoints` is user-initiated: Cloud sync (opt-in), licence-key validation when you activate a key (at CLI or dashboard activation only, no background re-check — works even with Cloud sync off), npm-registry update checks/updates (dashboard buttons or `shieldcortex update`), X-Ray package lookups (`shieldcortex xray` or the dashboard X-Ray page, tarball download with `--deep`), URLs you pass to `env scan`, and webhooks you configure (memory events and Iron Dome operator notifications). The dashboard binds to localhost by default but may be explicitly exposed with `SHIELDCORTEX_HOST`; when exposed, the loopback session-token endpoint stays disabled. The work
...[truncated 25 chars]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md
(`HOOK.md`, `handler.ts`, `runtime.mjs`) there so the gateway loads it from

Context Leakage

High
Category
Data Exfiltration
Confidence
92% confidence
Finding

Auto-capturing conversation content and persisting it to local memory can leak secrets, internal discussions, source code, or credentials into a long-lived datastore. The skill admits filtering is not perfect, so sensitive data may still be retained and later exposed through recall, local compromise, sync features, or operator error.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md
## Data handling, privacy & consent

ShieldCortex is **local-first**: memory, scanning, and audit run entirely on your machine — no account, no telemetry by default, and no network use beyond fetching the embedding model on first use when it is not cached (see **First-use model download** above). Because the tool can auto-capture conversation content, here is exactly what it reads, stores, and (only if you opt in) transmits.

- **What it reads.** With the lifecycle handlers enabled (opt-in at setup), ShieldCortex reads your agent **session transcripts — both your prompts and the assistant's replies** — to auto-extract memorable context. PreCompact (before context compaction) reads the recent transcript; the SessionEnd and Stop handlers are **off by default**; the OpenClaw integration extracts from assistant output (the `cortex-memory` hook does this on `/new` and `/stop` when `openclawAutoMemory` is `true`); the hook's keyword-trigger path is not registered on core OpenClaw 2026.9.6, so keyword phrases are not captured through it. SessionStart does **not** read transcripts (it only loads existing local memory and scans project rule files).
- **What it stores, and for how long.** Saved and auto-extracted memories are written to a **local SQLite database at `~/.shieldcortex/memories.db`** — title and content verbatim — and **persist across sessions** until you remove them (decay/consolidation prune low-value entries over time). Nothing is stored remotely unless you enable Cloud sync. Delete a memory with the `forget` tool, or remove the database to wipe everything.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

The skill explicitly states it reads full session transcripts, including user prompts and assistant replies, for auto-extraction into persistent memory. Even if opt-in, this is sensitive agent-context access that can capture secrets, proprietary data, or regulated content and persist it locally, increasing the blast radius of later compromise or misuse.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md
- **What it reads.** With the lifecycle handlers enabled (opt-in at setup), ShieldCortex reads your agent **session transcripts — both your prompts and the assistant's replies** — to auto-extract memorable context. PreCompact (before context compaction) reads the recent transcript; the SessionEnd and Stop handlers are **off by default**; the OpenClaw integration extracts from assistant output (the `cortex-memory` hook does this on `/new` and `/stop` when `openclawAutoMemory` is `true`); the hook's keyword-trigger path is not registered on core OpenClaw 2026.9.6, so keyword phrases are not captured through it. SessionStart does **not** read transcripts (it only loads existing local memory and scans project rule files).
- **What it stores, and for how long.** Saved and auto-extracted memories are written to a **local SQLite database at `~/.shieldcortex/memories.db`** — title and content verbatim — and **persist across sessions** until you remove them (decay/consolidation prune low-value entries over time). Nothing is stored remotely unless you enable Cloud sync. Delete a memory with the `forget` tool, or remove the database to wipe everything.
- **Secrets & credentials.** Every write — manual or auto-extracted — passes the defence pipeline first; high-confidence credential patterns (49 patterns across 25 providers) and content classified RESTRICTED are **blocked or quarantined before storage**, not saved as live memory. This is a strong filter, not a guarantee: low-confidence or low-entropy secrets can still be stored. On sensitive work, **review what auto-memory captures** and disable auto-extraction (`shieldcortex config --openclaw-auto-memory false`; the Claude Code handlers can be removed from `~/.claude/settings.json`).
- **Keyword triggers are dormant on OpenClaw.** The `cortex-memory` hook contains keyword auto-save code (e.g. "remember this", "don't forget"), but it is not registered on core OpenClaw 2026.9.6: the hook's `events` list has no `message` key, so 
...[truncated 25 chars]

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

md
## What it does NOT do

- Does **not** read SSH keys, AWS credentials, GPG keys, or /etc/ files
- Does **not** send your data to external servers, with three narrow, user-initiated exceptions: Cloud sync when you enable it, the subscription id sent to the licence endpoint when you activate a licence key, and event payloads to webhooks you configure (memory-event and Iron Dome operator notifications). Its remaining outbound calls are downloads/fetches that carry only the request itself — never memory or conversation content: npm-registry update checks and X-Ray package lookups (the package name appears in the URL), the huggingface.co embedding-model download, and URLs you explicitly pass to `env scan`
- Does **not** modify .bashrc, .zshrc, .profile, or shell configs
- Does **not** use `eval` or dynamic code execution of any kind

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

A self-update feature that can update the npm package, plugin, and skill modifies its own execution surface after installation. Without explicit mention of pinning, signature verification, or trusted update channels, this creates a substantial supply-chain and self-modification risk, especially for software embedded in agent workflows.

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

Maintenance

bash
shieldcortex update              # Self-update (npm package + OpenClaw plugin + skill)
shieldcortex maintain --dry-run  # Preview storage/memory hygiene (plain `maintain` applies it)

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

The audit mode's .env inspection again indicates direct access to credential-bearing files. For a memory tool that also persists extracted content and can optionally sync metadata/cloud state, this context makes secret-handling mistakes more dangerous even if the stated intent is defensive.

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

md
### `audit` checks:
- **Memory files** — ~/.claude/projects/, ~/.cursor/memories/, ~/.windsurf/memories/
- **Environment** — .env files for leaked credentials (read-only check, never writes)
- **MCP configs** — ~/.claude/mcp.json, ~/.openclaw/mcp.json, ~/.cursor/mcp.json, project-level equivalents
- **Rules files** — CLAUDE.md, .cursorrules, copilot-instructions.md for injection patterns

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
All data stays local in ~/.shieldcortex/. No account or API key needed
    for local use.
permissions:
  filesystem: readwrite
  network: optional
  credentials: optional
  justification: >

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The documented npx -y shieldcortex fallback executes an unpinned package fetched from the npm registry at runtime. That creates a supply-chain risk: if the package, a dependency, or the user's registry resolution is compromised, arbitrary code can run in the agent environment with the skill's available filesystem and configuration access.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md
This section explains every privileged operation the tool performs and why.

- **Active interception, not scan-only — on hosts that can deny.** Writes failing the pipeline are quarantined/blocked; recalled memory is trust/ACL-filtered before the agent sees it. Tool-call denial is **bound** on Claude Code (PreToolUse), OpenClaw (`before_tool_call`), and Hermes (`pre_tool_call`, enforce by default). Codex, Cursor, Copilot, and generic MCP get a memory server / scanner the model may ignore — they are **not bound**. Tool-output firewall defaults to advisory. `shieldcortex doctor` and `shieldcortex lease` report bound / not-bound / unknown per plane.
- **Setup is user-initiated, with one bounded exception.** Installing hooks, registering the MCP server, and migrating data are manual steps the user runs in their terminal, and bare `quickstart` / `setup` asks before each action; a named host, as in `setup claude`, is wired without asking. The npm postinstall script (disclosed in the trust table above) never adds integrations that weren't already present — on global installs it only prints instructions, checks the native binding, seeds default config on first install, and refreshes an existing OpenClaw hook/plugin install. The exception: the bundled cortex-memory hook performs a small automatic self-heal at gateway bootstrap, documented in full under **"Automatic self-heal at gateway bootstrap"** below.
- **Setup migrates legacy data.** The first `quickstart`/`setup` run may move or remove legacy config/memory directories (e.g. `~/.claude-cortex/`, `~/.claude-memory/`) into `~/.shieldcortex/` and copy hook files into place. This happens only on the user-run setup command — never on `npm install` (the postinstall script does not touch memory or config data beyond seeding defaults on a first-ever global install).
- **Destructive `forget` is bounded and gated.** Per-memory and filtered bulk deletes go through a delete ACL (own-only) and are recorded in the audit ledger. Revoke
...[truncated 25 chars]

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This line confirms the OpenClaw hook may download and execute shieldcortex on first use via npx -y shieldcortex when not locally installed. Automatic fetch-and-execute behavior materially increases supply-chain exposure because code execution occurs before a human can review the resolved package contents.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The self-heal routine explicitly performs writes without a prompt at gateway bootstrap and can copy hook files into canonical hook directories or delete legacy hook directories. Even though scope-limited and disclosed, automatic persistence/modification in startup paths can surprise users, complicate forensics, and provide a persistence foothold if the package is ever compromised.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
The cortex-memory hook registers for the `agent:bootstrap` event. On the first
bootstrap after each OpenClaw gateway start (once per gateway process), it runs
a self-check that can write without a prompt. In the interest of full
disclosure, this is exactly what it does:

1. **Removes stale legacy hook copies.** If the hook is running from its

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The same section documents an additional npx -y shieldcortex fallback that will fetch from npm and execute if no local install exists. In a security tool that hooks agent workflows and accesses local transcripts/configs, unpinned remote execution is especially risky because compromise would grant broad local insight and persistence opportunities.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The same section documents an additional npx -y shieldcortex fallback that will fetch from npm and execute if no local install exists. In a security tool that hooks agent workflows and accesses local transcripts/configs, unpinned remote execution is especially risky because compromise would grant broad local insight and persistence opportunities.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
78% confidence
Finding

This is another reference to npx mcporter in subprocess flows. Even with no shell injection path, unpinned transient execution remains a supply-chain weakness because the executable is resolved dynamically rather than from a reviewed, fixed local artifact.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

md
- Does **not** use `eval` or dynamic code execution of any kind
- Does **not** build subprocess commands from agent, memory, or network content. The update flow and the OpenClaw MCP bridge never spawn a shell — argv-array `execFile`/`spawn` only (`npm view` update check, `npm update`/`npm install`, `pgrep`, `npx mcporter`). The dashboard X-Ray surface adds two more argv-array, local-only children: `osascript` with fixed script lines (macOS folder picker) and ShieldCortex's own Node binary re-spawned for `xray --watch` background scans (hook and server helpers re-spawn `process.execPath` the same way, always with fixed local script paths). Sudo-aware home resolution validates the username, then runs `getent passwd <user>` as an argv-array — never through a shell, no tilde-eval. User-run CLI commands (setup, service, migrate, uninstall, audit, doctor, the npx-staleness warning) and corrupt-database recovery run fixed local admin tools (`npm`, `launchctl`, `systemctl`, `sqlite3`), some through a shell, parameterised only by local paths and usernames
- Does **not** bypass, disable, or override any agent safety mechanisms
- Does **not** auto-approve actions or skip verification prompts
- Does **not** mine cryptocurrency, trade tokens, manage wallets, or initiate purchases
- Does **not** make purchases, place orders, or move money on the user's behalf

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

md
- Does **not** use `eval` or dynamic code execution of any kind
- Does **not** build subprocess commands from agent, memory, or network content. The update flow and the OpenClaw MCP bridge never spawn a shell — argv-array `execFile`/`spawn` only (`npm view` update check, `npm update`/`npm install`, `pgrep`, `npx mcporter`). The dashboard X-Ray surface adds two more argv-array, local-only children: `osascript` with fixed script lines (macOS folder picker) and ShieldCortex's own Node binary re-spawned for `xray --watch` background scans (hook and server helpers re-spawn `process.execPath` the same way, always with fixed local script paths). Sudo-aware home resolution validates the username, then runs `getent passwd <user>` as an argv-array — never through a shell, no tilde-eval. User-run CLI commands (setup, service, migrate, uninstall, audit, doctor, the npx-staleness warning) and corrupt-database recovery run fixed local admin tools (`npm`, `launchctl`, `systemctl`, `sqlite3`), some through a shell, parameterised only by local paths and usernames
- Does **not** bypass, disable, or override any agent safety mechanisms
- Does **not** auto-approve actions or skip verification prompts
- Does **not** mine cryptocurrency, trade tokens, manage wallets, or initiate purchases
- Does **not** make purchases, place orders, or move money on the user's behalf

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

The hook is explicitly designed for persistent storage of extracted session content in a shared SQLite database, which creates a real confidentiality and retention risk if sensitive material is discussed in sessions. The context makes this more dangerous because the skill operates on transcripts and advertises cross-session reuse, increasing the blast radius of any accidental secret capture despite the described filtering pipeline.

Content

Scanner excerpt · bundled/cortex-memory-hook/HOOK.md (reported line 75)May include surrounding context.

md
## Defence Audit Guarantees

Every byte that lands in `memories` from the auto-extract path passes the
6-layer defence pipeline first. The hook write path is no longer the
bypass it once was:

- **ALLOW** → row inserted into `memories`; a corresponding row appears in

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill describes automatic transcript reading and storage, and notes that some fresh global installs enable openclawAutoMemory by default, but it does not present this as a prominent privacy warning at the top. Users may install or use the hook without realizing that session content, including potentially sensitive data, can be persisted to ~/.shieldcortex/memories.db.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
bundled/cortex-memory-hook/runtime.mjs:189