ShieldCortex

• Outcome: Review
• Latest audit: Sep 1, 2026 · 7:18 AM UTC
• Version: 4.54.15

Overview

This is a disclosed local-first memory and security integration with meaningful privacy considerations, but the inspected artifacts do not show hidden exfiltration or malicious behavior.

Install only if you want durable local memory and active memory-write protection. Review the auto-memory, proactive recall, cloud sync, audit logging, self-heal, and binaryPath settings before enabling integrations, and periodically inspect or delete stored memories in ~/.shieldcortex if you handle secrets or confidential work.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The top-level description materially understates behavior: beyond 'memory and defence', the skill reads agent configs, installs/repairs hooks, modifies MCP registration, auto-captures conversation content, performs self-heal file operations, and can send metadata to remote services. This gap is dangerous because users may grant trust and permissions based on a narrower summary than the actual operational scope.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The runtime resolves and executes external binaries from user-controlled configuration (`config.binaryPath`), from `which shieldcortex` on PATH, or via `npx -y shieldcortex`. That creates a command-execution trust boundary: a poisoned config, PATH hijack, or package-resolution issue can cause the agent to run unintended code, which is especially sensitive in a security tool that may be invoked automatically.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The plugin registers a before_tool_call hook that can deliberately block tool invocations by propagating interceptor errors prefixed with 'ShieldCortex:'. That goes beyond passive scanning and into active policy enforcement, which is security-relevant because it can alter agent behavior and deny operations not clearly disclosed by the plugin’s stated scanning/recall role.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The code constructs an audit entry containing preview text from flagged user input, then passes that same object to cloudSync while claiming no raw LLM input leaves the plugin. If cloudSync fails to reliably strip previews in every path, sensitive prompt data may be exfiltrated to a remote service under a misleading privacy guarantee.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The interceptor persists a preview of intercepted memory content to ~/.shieldcortex/audit as JSONL, which can include sensitive prompts, secrets, proprietary data, or other user memory content. Because this plugin’s role is defensive scanning of memory operations, storing inspected content to disk increases the attack surface and creates a secondary data-retention channel that may be readable by other local processes, backups, or support tooling.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list is broad enough that normal conversation can unintentionally activate persistent storage, especially phrases like 'this is important', 'i learned', or 'we decided'. Because the hook stores following content into long-lived memory, this can capture sensitive, irrelevant, or attacker-influenced text without clear user intent.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The documentation says auto-memory is enabled by default and describes storage in a persistent SQLite database, but it does not present a strong, prominent warning that session transcript content may be captured and retained automatically. Users may therefore disclose secrets, personal data, or proprietary information under the mistaken assumption that only deliberate notes are stored.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Every user message is sent to the recall function when proactive recall is enabled, with no visible consent or disclosure in this file beyond internal config. That creates a privacy risk because potentially sensitive user prompts are continuously transmitted to the memory subsystem for semantic search, which may surprise users and increase data exposure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Keyword-triggered saving stores user-supplied content into persistent memory whenever natural-language triggers match, but the only safeguard is the trigger phrase itself and a post-save confirmation. Users can easily include credentials, tokens, personal data, or other secrets after phrases like 'remember this', causing unintended long-term storage of sensitive content.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: scanRealtimeContent sends full text content to callCortex('scan_tool_response'), which appears to perform remote or external scanning. Because this occurs automatically on LLM inputs and the plugin is specifically handling potentially sensitive prompts, transmitting content without clear runtime consent or prominent disclosure creates a privacy and data-handling vulnerability.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The plugin automatically persists assistant output into ShieldCortex memory via callCortex('remember') without any explicit per-use warning. Assistant responses often echo or transform user secrets, making silent persistence a privacy and retention risk, especially when memory is reused later.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: When threats are detected, the plugin writes a preview of user input to a local audit log under the user's home directory. Even though the preview is truncated, it can still capture credentials, personal data, or confidential prompts without a clear warning, creating local privacy exposure.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This code writes intercepted content previews to local files without any visible user-consent or notice mechanism in the file, so sensitive user data may be silently retained outside the expected memory-defense flow. Even truncated previews can expose credentials, private notes, or prompt contents, and the 'best-effort' logging means this exfiltration-to-disk occurs opportunistically without blocking normal operation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The manifest advertises automatic memory extraction from LLM output and optional realtime threat forwarding to a cloud API, but the user-facing help text does not clearly warn that model outputs may contain sensitive data and could be stored or transmitted externally. In a security product that hooks llm_input, llm_output, and tool calls, this creates meaningful privacy and data-governance risk because users may enable features without understanding the scope of collection and forwarding.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: The hook is explicitly designed to capture transcript content at session end and store extracted memories persistently. Even if intended functionality, this creates a real data-retention and privacy risk because sensitive information from ordinary agent sessions can be written to local memory stores and later resurfaced.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The keyword-trigger mechanism saves content following natural-language phrases, which means arbitrary text can be persisted when those phrases appear in conversation, logs, pasted documents, or attacker-crafted prompts. This increases the chance of storing prompt-injection payloads, credentials, or misleading instructions for future retrieval, even with a downstream defence pipeline.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The trigger list includes broad phrases such as 'remember this' and 'don't forget', and the extraction path persists the following user text as memory. Because there is no secret-detection or sensitivity gate before storage, an attacker or unsuspecting user can cause passwords, tokens, recovery codes, or confidential instructions to be retained in durable memory.

Ssd 3

Medium

• Confidence: 80% confidence
• Finding: The feature set explicitly includes automatic memory extraction from model outputs, which can indirectly retain user-provided sensitive data if the assistant repeats or summarizes it. In a memory-focused skill this is functionally intended, but still dangerous because retained data may later be surfaced in unrelated contexts.

Ssd 3

Medium

• Confidence: 89% confidence
• Finding: The extraction heuristics prefer 'remember', 'important', 'always/never', and similar high-salience text patterns. Those patterns can easily match assistant output that contains operational secrets, credentials handling guidance, user instructions, or private reminders, increasing the chance that sensitive content is persisted as reusable memory.

Ssd 3

High

• Confidence: 97% confidence
• Finding: Saved memories are created with scope: 'global', making information extracted from one session available across future sessions and potentially other projects or agents. This materially increases confidentiality risk because sensitive details can persist beyond their original context and be retrieved or reused later.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

- $CWD/.claude/, $CWD/.cursor/ (project-level configs)
    - $CWD/.cursorrules, $CWD/.windsurfrules, $CWD/.clinerules
    - $CWD/CLAUDE.md, $CWD/copilot-instructions.md
    - $CWD/.aider.conf.yml, $CWD/.continue/config.json
    - $CWD/.env (env-scanner checks for leaked secrets — reads, never writes)
  paths_write:
    - ~/.shieldcortex/ (memory DB, config, cortex log, licence, audit cache)

• Confidence: 87% confidence
• Finding: The skill declares read access to numerous agent instruction and configuration files across multiple tools, including project-level rule files and .continue config. Even if intended for security scanning, broad access to agent configs can expose sensitive prompts, system instructions, workflow settings, and embedded secrets, expanding the blast radius if the tool is compromised or misbehaves.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

- **First-use model download (huggingface.co).** Semantic memory runs a local embedding model (Xenova/all-MiniLM-L6-v2, ~90 MB ONNX) that is **not bundled** with the package. Whenever it is missing from `~/.cache/shieldcortex/models`, the MCP server downloads it from huggingface.co — triggered by the background preload at server start, or by the first operation that needs an embedding, plus a single re-download if a cached copy is detected corrupt. This is the one network call that is not user-initiated. Avoid it with `SHIELDCORTEX_SKIP_EMBEDDINGS=1` (memory falls back to full-text search) or by pre-seeding the model cache. The optional Local AI Explainer (`review-copilot`) downloads its model from the same host only on an explicit, consent-prompted `enable`/`download-model` command; its review runs never fetch remotely.
- **Network is off by default, with the first-run exception above.** With no licence key activated, no Cloud sync enabled, and no webhooks configured, ShieldCortex's only outbound connections are the embedding-model download just described (fires on server start when the model is not cached) and one further caveat: the OpenClaw hook's `npx -y shieldcortex` fallback downloads the package on first use when ShieldCortex is not installed locally — see `network_endpoints`. Every other entry in `network_endpoints` is user-initiated: Cloud sync (opt-in), licence-key validation when you activate a key (at CLI or dashboard activation only, no background re-check — works even with Cloud sync off), npm-registry update checks/updates (dashboard buttons or `shieldcortex update`), X-Ray package lookups (`shieldcortex xray` or the dashboard X-Ray page, tarball download with `--deep`), URLs you pass to `env scan`, and webhooks you configure (memory events and Iron Dome operator notifications). The dashboard binds to localhost by default but may be explicitly exposed with `SHIELDCORTEX_HOST`; when exposed, the loopback session-token endpoint stays disabled. The work
...[truncated 25 chars]

• Confidence: 88% confidence
• Finding: Registering lifecycle handlers in ~/.claude/settings.json gives the tool persistent access to conversation flow and prompt-time interception, which is a privileged integration point. Because this can alter what context is injected and what transcripts are read, it creates a durable foothold in the agent environment that could be abused if the package is compromised.

MCP Config Access

High

• Category: Agent Snooping

Content

- ~/.shieldcortex/ (memory DB, config, cortex log, licence, audit cache)
    - ~/.cache/shieldcortex/models (embedding model download cache)
    - ~/.openclaw/extensions/shieldcortex-realtime/ (OpenClaw plugin via the wrapper install only; native `openclaw plugins install` uses OpenClaw's managed npm tree instead)
    - ~/.claude/mcp.json, ~/.cursor/mcp.json (MCP server registration, when user runs setup)
  network_endpoints:
    - https://api.shieldcortex.ai (Cloud sync + audit telemetry — only when Cloud sync is enabled; licence validation — only when a licence key is activated, fired at CLI `license activate` and the dashboard's activation call (POST /api/license/activate), with no periodic or background re-check; sends the subscription id, works with Cloud sync off; never called when no key is configured)
    - https://huggingface.co (embedding-model download — Xenova/all-MiniLM-L6-v2, ~90 MB, fetched into ~/.cache/shieldcortex/models by the MCP server's background preload at startup or the first operation needing an embedding, whenever the model is not already cached, plus one re-download if a cached copy is detected corrupt; SHIELDCORTEX_SKIP_EMBEDDINGS=1 prevents it. The optional Local AI Explainer model downloads from the same host only on explicit, consent-prompted `review-copilot enable`/`download-model` — its review runs use the local cache only)

• Confidence: 90% confidence
• Finding: Writing to MCP configuration files such as ~/.claude/mcp.json and ~/.cursor/mcp.json establishes persistent execution/integration for the tool inside agent clients. This is security-sensitive because MCP registration can affect future sessions and may become a persistence or interception mechanism if altered unexpectedly or by a compromised package.

MCP Config Access

High

• Category: Agent Snooping

Content

### `audit` checks:
- **Memory files** — ~/.claude/projects/, ~/.cursor/memories/, ~/.windsurf/memories/
- **Environment** — .env files for leaked credentials (read-only check, never writes)
- **MCP configs** — ~/.claude/mcp.json, ~/.openclaw/mcp.json, ~/.cursor/mcp.json, project-level equivalents
- **Rules files** — CLAUDE.md, .cursorrules, copilot-instructions.md for injection patterns

## What Gets Uploaded to Cloud

• Confidence: 76% confidence
• Finding: Reading MCP configs is less severe than writing them, but it still exposes agent integration details, server endpoints, and possibly auth-related settings. In a security tool this can be contextually justified, yet it remains privileged discovery of control-plane configuration.

Context Leakage

High

• Category: Data Exfiltration

Content

## Data handling, privacy & consent

ShieldCortex is **local-first**: memory, scanning, and audit run entirely on your machine — no account, no telemetry by default, and no network use beyond fetching the embedding model on first use when it is not cached (see **First-use model download** above). Because the tool can auto-capture conversation content, here is exactly what it reads, stores, and (only if you opt in) transmits.

- **What it reads.** With the lifecycle handlers enabled (opt-in at setup), ShieldCortex reads your agent **session transcripts — both your prompts and the assistant's replies** — to auto-extract memorable context. PreCompact (before context compaction) reads the recent transcript; the SessionEnd and Stop handlers are **off by default**; the OpenClaw integration extracts from assistant output and explicit keyword triggers. SessionStart does **not** read transcripts (it only loads existing local memory and scans project rule files).
- **What it stores, and for how long.** Saved and auto-extracted memories are written to a **local SQLite database at `~/.shieldcortex/memories.db`** — title and content verbatim — and **persist across sessions** until you remove them (decay/consolidation prune low-value entries over time). Nothing is stored remotely unless you enable Cloud sync. Delete a memory with the `forget` tool, or remove the database to wipe everything.

• Confidence: 93% confidence
• Finding: The skill can read full session transcripts, including user prompts and assistant replies, then persist extracted content to local memory and optionally sync some memory content to cloud features if enabled. This is dangerous because transcripts often contain secrets, proprietary code, credentials, and sensitive business context, and automatic capture increases the chance of over-collection.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: bundled/cortex-memory-hook/runtime.mjs:181