ShieldCortex

Persistent memory and security system for AI agents. Stores memories with semantic search, knowledge graphs, and decay. Scans agent inputs/outputs for prompt...

ShieldCortex appears to implement the memory+scan features it claims, but it requires broad read access to agent/project config files (including $CWD/.env) and can modify other agents' config to register lifecycle hooks. It also falls back to running 'npx -y shieldcortex' which will fetch and run code from npm on first use. Before installing: 1) Review the bundled runtime files yourself (they are included) and confirm you trust the upstream package on npm/github; 2) Do not enable cloud sync or supply a cloud API key unless you trust the service and its team; 3) If you want to avoid network/supply-chain risk, install the shieldcortex binary from a vetted source ahead of time and set binaryPath/SHIELDCORTEX_ROOT so the plugin uses a known local binary; 4) Be cautious about auto-enable options that modify ~/.claude or other agent configs—backup those files first and require explicit consent to change them; 5) If you store secrets in project .env files, consider removing them or restricting access before allowing this skill to scan them. If you want a lower-risk posture, prefer a version that only uses the bundled runtime without on-demand npx installs and that does not auto-write other agents' settings.

Type: OpenClaw Skill Name: shieldcortex Version: 4.12.11 The ShieldCortex bundle provides a legitimate persistent memory and security auditing system for AI agents. While it requests broad filesystem access (reading .env files and various agent configuration directories like ~/.claude and ~/.cursor), these actions are clearly documented and aligned with its stated purpose of scanning for credential leaks and prompt injection. The code uses execFile for process execution and includes a cloud sync feature that is disabled by default and requires a user-provided API key. No evidence of obfuscation, intentional data exfiltration, or malicious prompt injection was found in index.js, runtime.mjs, or the markdown files.