Is jarvis-drakon/shieldcortex-skill safe?
https://github.com/openclaw/skills/tree/main/skills/jarvis-drakon/shieldcortex-skill
ShieldCortex is a documentation-only skill with a clean installation footprint — two static files, no executable code, no npm install during clone, and no unexpected network activity. However, the SKILL.md instructs agents to install an unaudited global npm package, includes a cloud sync feature that transmits agent memories to a third-party server, and deploys an OpenClaw hook that permanently injects stored content into agent context at every session start — creating a persistent cross-session prompt injection surface. The security-tool framing is the most deceptive aspect: it positions memory injection as a defense mechanism while the mechanism itself is the primary attack vector.
Category Scores
Findings (8)
HIGH Cloud sync exfiltrates agent memories to third-party server -20 ▶
ShieldCortex Cloud feature sends stored agent memories, session context, and audit data to shieldcortex.ai. Users activating this optional feature expose their agent's full memory history — including architecture decisions, credentials mentioned in conversation, and flagged threat content — to an external server operated by Drakon-Systems-Ltd. The SKILL.md normalizes this by presenting it as a team collaboration feature.
HIGH npm install -g shieldcortex introduces unaudited supply chain -18 ▶
SKILL.md instructs the agent to globally install shieldcortex from npmjs.com. The package exports 70 named functions and was not installed or audited during this engagement. A malicious or compromised npm package could execute arbitrary code via postinstall scripts, and global installation affects the entire user system rather than a sandboxed directory.
HIGH Memory injection creates persistent cross-session prompt injection vector -15 ▶
The OpenClaw hook injects 'relevant past memories' into agent context at every session start. This is an architectural design that routes untrusted stored content through the agent's instruction stream. If any source (web content, email, another skill, or a compromised cloud sync) can write to the memory store, it achieves persistent prompt injection that survives session restarts, context compaction, and agent reinstalls.
MEDIUM OpenClaw hook permanently modifies agent startup without per-session consent -8 ▶
Running 'shieldcortex openclaw install' installs a persistent system-level hook that activates on every subsequent agent restart. The hook automatically modifies agent context and saves session data without requiring user confirmation at each session. This creates an always-on behavior modification mechanism that outlasts the user's awareness of the initial install decision.
MEDIUM Skill scanner reads all installed agent instruction files -10 ▶
The scan-skills command scans all installed SKILL.md, .cursorrules, and CLAUDE.md files in the agent environment. Combined with cloud sync, this creates a mechanism to exfiltrate all instruction files — including proprietary system prompts, tool configurations, and security policies — to an external server. Even without cloud sync, the local aggregation of all instruction files into a searchable database is a data concentration risk.
MEDIUM Security-tool framing creates false trust and widens attack surface -20 ▶
ShieldCortex positions itself as a defense layer against the exact attacks it enables. The '6-layer defence pipeline' framing encourages users to trust that stored memories are safe, while the memory injection mechanism is itself the primary attack surface. A sophisticated attacker would target ShieldCortex specifically because compromising it yields persistent cross-session influence. Additionally, the skill scanner claiming to detect threats in other skills could be used to map the agent's full instruction environment.
LOW shieldcortex openclaw install deploys persistent system hook -5 ▶
The documented install path for OpenClaw integration deploys a hook that persists across restarts and modifies agent behavior automatically. While documented behavior, this represents a permanent change to the agent environment that is difficult to fully audit or remove without knowing the hook's implementation details in the unaudited npm package.
INFO Credential file reads attributable to audit infrastructure, not skill -5 ▶
Inotifywait and auditd recorded reads of .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and GCP credentials. Analysis of timestamps shows first access at 1771906183 (6 seconds before git clone at 1771906189) and second access at 1771906206 (5 seconds after installation completed at 1771906201). No skill-spawned process appears in EXECVE logs accessing these paths. The audit framework's own canary integrity check confirms all files unmodified. These reads are consistent with the audit system's baseline and post-install verification passes.