registry / shadow-claw / 1.34.2

shadow-claw@1.34.2

Browser-native personal AI assistant.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user runs the shadow-claw CLI agent or local-model features and supplies a workspace, tool, model, or service configuration.

Impact

A user can grant the package's agent access to configured tools, local executables, workspace files, and configured credentials or service endpoints.

Mechanism

User-invoked agent tool execution, local process launch, and configured network requests.

AI rationale

This is a high-capability agent package with process execution and credential-handling paths, so it warrants a warning. The inspected paths are user-invoked or configuration-driven and do not establish concrete malicious behavior.

Evidence

bin/commands/agent.mjssrc/server/services/llamafile-manager.tsdist/lib/orchestrator-DKe5ferf.jsdist/lib/mcp-reconnect-COdZ-cea.jsdist/server.js.agents/skills.agents/toolsdatabase

Network endpoints1

/oauth/refresh

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package exposes a command-line executable that can invoke its agent functionality.
The headless agent command creates an agent workspace with skills and tools directories.
The agent command resolves declarative tools and executes a selected tool with supplied input.
The local-model service launches a selected local executable, including a shell fallback.
The built browser bundle contains an executable-command adapter that captures process output.
OAuth refresh code sends a decrypted refresh token to the application's refresh endpoint.
A test evaluates a local bridge script, but this is test-only code.
The production bundle makes network requests to configured model URLs.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
The agent workspace and tool execution paths require an explicit CLI action.
The local-model proxy restricts hosts to loopback unless an environment variable explicitly permits otherwise.
No fixed attacker-controlled endpoint, automatic credential harvesting, or install-time mutation was confirmed.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

CopyleftLicense

scanned 1,551 file(s), 29.0 MB of source, external domains: 10.0.0.1, 10.0.0.2, 10.0.0.5, 10.9.8.226, 127.0.0.1, 169.254.169.254, 172.16.0.5, 172.20.0.1, 172.20.0.5, 192.168.1.1, 192.168.1.10, 192.168.1.100, 192.168.1.5, 192.168.1.50, a2ui.org, accounts.google.com, actions.google.com, agent-card.github.io, ai.google.dev, aiplatform.googleapis.com, allowed.example.com, another.com, any.example.com, api.example.com, api.external.com, api.figma.com, api.github.com, api.hf.co, api.linear.app, api.login.yahoo.com, api.myservice.com, api.nodemailer.com, api.notion.com, api.openai.com, api.telegram.org, api.test, api.test.example, app.internal, app.vssps.visualstudio.com, attacker.com, attacker.github.io, auth.atlassian.com, auth.example.com, auth.openai.com, bad.example.com, bible-tools.github.io, bit.ly, bridge.example, bridge.example.com, cdn-lfs.huggingface.co

Oversized source lightweight scan

dist/electron/main.cjs2.65 MB file, sampled 256 KB

FilesystemNetworkChildProcessCryptoHighEntropyStringsMinifiedUrlStrings127.0.0.1accounts.google.comapi.figma.comapi.linear.appapi.login.yahoo.comapi.nodemailer.comapi.notion.comapi.telegram.orgapp.vssps.visualstudio.comauth.atlassian.comcdn.jsdelivr.netcdnjs.cloudflare.comethereal.emailexample.comfonts.googleapis.comfonts.gstatic.comgithub.comgitlab.comlinear.applogin.microsoftonline.commail.google.comnodemailer.comoauth2.googleapis.compeerjs.com

dist/headless-agent.js6.78 MB file, sampled 256 KB

FilesystemNetworkDynamicRequireHighEntropyStringsMinifiedUrlStringsaccounts.google.comapi.figma.comapi.linear.appapi.login.yahoo.comapi.notion.comapp.vssps.visualstudio.comauth.atlassian.comcdn.jsdelivr.netdeepwiki.comexample.comgithub.comgitlab.comhuggingface.colinear.applogin.microsoftonline.comoauth2.googleapis.comopenrouter.airouter.huggingface.coslack.comwww.figma.comwww.w3.orgxt-ml.github.io

dist/lib/webllm-BwoH9pq3.js6.15 MB file, sampled 256 KB

NetworkHighEntropyStringsUrlStringshuggingface.coraw.githubusercontent.comwebgpureport.org

dist/public/pdf.worker.js2.06 MB file, sampled 256 KB

NetworkDynamicRequireUrlStringsexample.com

dist/public/webllm-BDMz9yZR.js5.75 MB file, sampled 256 KB

FilesystemNetworkHighEntropyStringsMinifiedUrlStringshuggingface.coraw.githubusercontent.comwebgpureport.org

dist/server.js2.44 MB file, sampled 256 KB

FilesystemNetworkWebSocketHighEntropyStringsMinifiedUrlStringsaccounts.google.comapi.figma.comapi.linear.appapi.login.yahoo.comapi.notion.comapi.telegram.orgapp.vssps.visualstudio.comauth.atlassian.comcdn.jsdelivr.netcdnjs.cloudflare.comexample.comfonts.googleapis.comfonts.gstatic.comgithub.comgitlab.comlinear.applogin.microsoftonline.comoauth2.googleapis.comslack.comwww.figma.comwww.w3.orgwww.youtube.comxt-ml.github.io

Source & flagged code

19 flagged

dist/lib/bundler-CsL7hHMq.jsView file

Lines 1803-1843javascript

1803 mkiValue: parts[2] ? parts[2].split(":")[0] : void 0,

1804 mkiLength: parts[2] ? parts[2].split(":")[1] : void 0

1805 };

1806 };

1807 SDPUtils.writeCryptoKeyParams = function(keyParams) {

1808 return keyParams.keyMethod + ":" + keyParams.keySalt + (keyParams.lifeTime ? "|" + keyParams.lifeTime : "") + (keyParams.mkiValue && keyParams.mkiLength ? "|" + keyParams.mkiValue + ":"

1809 };

1810 SDPUtils.getCryptoParameters = function(mediaSection, sessionpart) {

1811 return SDPUtils.matchPrefix(mediaSection + sessionpart, "a=crypto:").map(SDPUtils.parseCryptoLine);

1812 };

1813 SDPUtils.getIceParameters = function(mediaSection, sessionpart) {

1814 const ufrag = SDPUtils.matchPrefix(mediaSection + sessionpart, "a=ice-ufrag:")[0];

1815 const pwd = SDPUtils.matchPrefix(mediaSection + sessionpart, "a=ice-pwd:")[0];

1816 if (!(ufrag && pwd)) return null;

1817 return {

1818 usernameFragment: ufrag.substring(12),

1819 password: pwd.substring(10)

1820 };

1821 };

1822 SDPUtils.writeIceParameters = function(params) {

1823 let sdp = "a=ice-ufrag:" + params.usernameFragment + "\r\na=ice-pwd:" + params.password + "\r\n";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/lib/bundler-CsL7hHMq.jsView on unpkg · L1823

1824 if (params.iceLite) sdp += "a=ice-lite\r\n";

1825 return sdp;

1826 };

1827 SDPUtils.parseRtpParameters = function(mediaSection) {

1828 const description = {

1829 codecs: [],

1830 headerExtensions: [],

1831 fecMechanisms: [],

1832 rtcp: []

1833 };

1834 const mline = SDPUtils.splitLines(mediaSection)[0].split(" ");

1835 description.profile = mline[2];

1836 for (let i = 3; i < mline.length; i++) {

1837 const pt = mline[i];

1838 const rtpmapline = SDPUtils.matchPrefix(mediaSection, "a=rtpmap:" + pt + " ")[0];

1839 if (rtpmapline) {

1840 const codec = SDPUtils.parseRtpMap(rtpmapline);

1841 const fmtps = SDPUtils.matchPrefix(mediaSection, "a=fmtp:" + pt + " ");

1842 codec.parameters = fmtps.length ? SDPUtils.parseFmtp(fmtps[0]) : {};

1843 codec.rtcpFeedback = SDPUtils.matchPrefix(mediaSection, "a=rtcp-fb:" + pt + " ").map(SDPUtils.parseRtcpFb);

bin/version.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execSync } from "node:child_process";

4import { readFile, writeFile, stat } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/version.mjsView on unpkg · L2

5import path from

src/server/services/llamafile-manager.tsView file

Lines 620-660typescript

620 error && typeof error === "object"

621 ? String((error as any).code ?? "")

622 : ""

src/components/shadow-claw-file-viewer/iframe-storage-bridge.test.tsView file

Lines 6-46typescript

6import path from "node:path";

7import { fileURLToPath } from "node:url";

9const __filename = fileURLToPath(import.meta

bin/utils/agent-core.mjsView file

Lines 1-41javascript

1import { existsSync } from "node:fs";

2import path from "node:path";

3import process from "node:process";

4import { fileURLToPath, pathToFileURL } from "node:url";

src/service-worker/patch-service-worker-trusted-types.test.jsView file

Lines 1-21javascript

1import { describe, expect, it, jest } from "@jest/globals";

2import vm from "node:vm";

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

src/service-worker/patch-service-worker-trusted-types.test.jsView on unpkg · L1

4import { patchServiceWorkerTrustedTypes } from

dist/electron/main.cjsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/electron/main.cjsView on unpkg

1var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t,n)=>()=>... L2: `).join(`\r ... L21: public_key TEXT NOT NULL, L22: private_key TEXT NOT NULL, L23: subject TEXT NOT NULL ... L85: ${r(s)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let n of e.split(`/`))n?.length!==0&&n!==`.`&&(n===`..`?t.pop():t.push(n));let n=`${e?.startsWith(`/`)?`/`:`... L86: `);return this.signString(h,{signingDate:n,signingRegion:c,signingService:o,eventStreamCredentials:s})}async signMessage(e,{signingDate:t=new Date,signingRegion:n,signingService:r,... L87: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html ... L98: `)?

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/electron/main.cjsView on unpkg · L1

dist/server.jsView file

127/*! node-domexception. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */ L128: if(!globalThis.DOMException)try{let{MessageChannel:e}=H(`worker_threads`),t=new e().port1,n=new ArrayBuffer;t.postMessage(n,[n,n])}catch(e){e.constructor.name===`DOMException`&&(gl... L129: --`+e;let t=new Uint8Array(e.length);for(let n=0;n<e.length;n++)t[n]=e.charCodeAt(n),this.boundaryChars[t[n]]=!0;this.boundary=t,this.lookbehind=new Uint8Array(this.boundary.length... L130: \r ... L138: `+f+`}`:`{`+p.join(`,`)+`}`,t=f,u}}typeof r.stringify!=`function`&&(r.stringify=function(e,n,r){var a;if(t=``,i=``,typeof r==`number`)for(a=0;a<r;a+=1)i+=` `;else typeof r==`string... L139: `,r:`\r`,t:` `},c,l=function(e){throw{name:`SyntaxError`,message:e,at:a,text:c}},u=function(e){return e&&e!==o&&l(

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/server.jsView on unpkg · L127

127Trigger-reachable chain: scripts.start -> dist/server.js L127: /*! node-domexception. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */ L128: if(!globalThis.DOMException)try{let{MessageChannel:e}=H(`worker_threads`),t=new e().port1,n=new ArrayBuffer;t.postMessage(n,[n,n])}catch(e){e.constructor.name===`DOMException`&&(gl... L129: --`+e;let t=new Uint8Array(e.length);for(let n=0;n<e.length;n++)t[n]=e.charCodeAt(n),this.boundaryChars[t[n]]=!0;this.boundary=t,this.lookbehind=new Uint8Array(this.boundary.length... L130: \r ... L138: `+f+`}`:`{`+p.join(`,`)+`}`,t=f,u}}typeof r.stringify!=`function`&&(r.stringify=function(e,n,r){var a;if(t=``,i=``,typeof r==`number`)for(a=0;a<r;a+=1)i+=` `;else typeof r==`string... L139: `,r:`\r`,t:` `},c,l=function(e){throw{name:`SyntaxError`,

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server.jsView on unpkg · L127

bin/commands/agent.mjsView file

72const raw = await readFile(p, "utf8"); L73: const parsed = JSON.parse(raw); L74: if (parsed && typeof parsed === "object") { ... L95: const resolved = await resolveCacheDir({ L96: contentRoot: process.cwd(), L97: cacheDir: options.cacheDir, ... L103: stdin: options.stdin, L104: stdout: options.stdout, L105: }); ... L137: : Boolean( L138: process.env.CI && L139: !["0", "false"].includes(process.env.CI.toLowerCase()),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/commands/agent.mjsView on unpkg · L72

bin/build/build.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. build:clean", { cwd: toolchainroot }); await run("npm run -s rolldown", { cwd: toolchainroot }); } await cp(toolchaindist, distpublicdir, { recursive: true }); const contentassets = join(contentroot, "assets"); if (await pathexists(contentassets)) { if (copyallassets) { await cp(contentassets, distpublicdir, { recursive: true, force: true }); } else { if (await pathexists(join(contentassets, "icons"))) { await cp( join(contentassets, "icons"), join(distpublicdir, "assets/icons"), { recursive: true, force: true }, );

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/build/build.mjsView on unpkg

dist/lib/orchestrator-DKe5ferf.jsView file

22Cross-file remote execution chain: dist/lib/orchestrator-DKe5ferf.js spawns dist/lib/git-COWGgQY_.js; helper contains network access plus dynamic code execution. L22: import { a as require_define_data_property, c as require_hasown, d as require_type, f as require_es_object_atoms, h as require_stream_browserify, i as require_has_property_descript... L23: import { n as require_inflate, o as require_zstream, r as require_deflate, t as require_constants } from "./constants-DsXVuJVP.js"; L24: import { a as upsertEmailConnection, i as listEmailConnections, n as deleteEmailConnection, o as getEmailPluginManifest, r as getEmailConnection, s as listEmailPluginManifests, t a... ... L34: label: "OpenRouter API Keys", L35: href: "https://openrouter.ai/keys" L36: }, ... L924: let output = ""; L925: if

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/lib/orchestrator-DKe5ferf.jsView on unpkg · L22

dist/headless-agent.jsView file

•path = dist/headless-agent.js kind = oversized_source_file sizeBytes = 7111614 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/headless-agent.jsView on unpkg

dist/lib/git-COWGgQY_.jsView file

15651patternName = generic_password severity = medium line = 15651

Medium

Secret Pattern

Hardcoded password in dist/lib/git-COWGgQY_.js

dist/lib/git-COWGgQY_.jsView on unpkg · L15651

src/subsystems/git/git.tsView file

844patternName = generic_password severity = medium line = 844

Medium

Secret Pattern

Hardcoded password in src/subsystems/git/git.ts

src/subsystems/git/git.tsView on unpkg · L844

Source & flagged code

19 flagged · loading source

dist/lib/bundler-CsL7hHMq.jsView file

1823patternName = generic_password severity = medium line = 1823

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/lib/bundler-CsL7hHMq.jsView on unpkg · L1823

bin/version.mjsView file

2L3: import { execSync } from "node:child_process"; L4: import { readFile, writeFile, stat } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/version.mjsView on unpkg · L2

src/server/services/llamafile-manager.tsView file

640console.log( L641: `[Proxy] Shell fallback: /bin/sh -c 'exec "\$0" "\$@"' ${absolutePath} [${args.length} args]`, L642: );

High

Shell

Package source references shell execution.

src/server/services/llamafile-manager.tsView on unpkg · L640

src/components/shadow-claw-file-viewer/iframe-storage-bridge.test.tsView file

26// eslint-disable-next-line no-eval L27: eval(scriptCode); L28: });

High

Eval

Package source references dynamic code evaluation.

src/components/shadow-claw-file-viewer/iframe-storage-bridge.test.tsView on unpkg · L26

bin/utils/agent-core.mjsView file

21if (!isTest && existsSync(distAgentPath)) { L22: cachedCore = await import(pathToFileURL(distAgentPath).href); L23: return cachedCore;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/utils/agent-core.mjsView on unpkg · L21

src/service-worker/patch-service-worker-trusted-types.test.jsView file

1import { describe, expect, it, jest } from "@jest/globals"; L2: import vm from "node:vm";

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

src/service-worker/patch-service-worker-trusted-types.test.jsView on unpkg · L1

dist/electron/main.cjsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/electron/main.cjsView on unpkg

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/electron/main.cjsView on unpkg · L1

dist/server.jsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/server.jsView on unpkg · L127

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server.jsView on unpkg · L127

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/server.js: import e,{createRequire as t}from"node:module";import n from"process";import{env as r,exit as i}from"node:process";import a from"node:http";import o from"node:https";import s,{base... `).run(e.clientId,e.deviceLabel,a,e.version,i,r,t),{clientId:e.clientId,deviceLabel:e.deviceLabel,capabilities:e.capabilities,version:e.version,peerId:i||void 0,connectedAt:r,lastS... `,`utf8`)}catch{}try{let e=s.join(h(),`shadow-claw`);l.existsSync(e)||l.mkdirSync(e,{recursive:!0}),l.writeFileSync(s.join(e,`control-token.json`),JSON.stringify(o,null,2)+` `+u),ye&&(u=gt(u)),S&&Oe?O(u):u},t.setConfig=function(){let e=arguments.length>0&&arg

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/server.jsView on unpkg

1import e,{createRequire as t}from"node:module";import n from"process";import{env as r,exit as i}from"node:process";import a from"node:http";import o from"node:https";import s,{base... L2: CREATE TABLE IF NOT EXISTS vapid_keys ( ... L4: public_key TEXT NOT NULL, L5: private_key TEXT NOT NULL, L6: subject TEXT NOT NULL ... L102: `+u),ye&&(u=gt(u)),S&&Oe?O(u):u},t.setConfig=function(){let e=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};nt(e),Se=!0,Ce=z,we=le},t.clearConfig=function(){$e=null,Se=... L103: `)||n,code:r,status:t},e.data.error)}return Object.assign({message:n,code:r,status:t},e.data.error)}}return{message:n,code:e.status,status:e.statusText}}};function i(e,t){switch(e)... L104: `).join(` ... L138: `+f+`}`:`{`+p.join(`,`)+`}`,t=f,u}}typeof r.stringify!=`function`&&

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/server.jsView on unpkg · L1

127Trigger-reachable command-output exfiltration chain: scripts.start -> dist/server.js L127: /*! node-domexception. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */ L128: if(!globalThis.DOMException)try{let{MessageChannel:e}=H(`worker_threads`),t=new e().port1,n=new ArrayBuffer;t.postMessage(n,[n,n])}catch(e){e.constructor.name===`DOMException`&&(gl... L129: --`+e;let t=new Uint8Array(e.length);for(let n=0;n<e.length;n++)t[n]=e.charCodeAt(n),this.boundaryChars[t[n]]=!0;this.boundary=t,this.lookbehind=new Uint8Array(this.boundary.length... L130: \r ... L138: `+f+`}`:`{`+p.join(`,`)+`}`,t=f,u}}typeof r.stringify!=`function`&&(r.stringify=function(e,n,r){var a;if(t=``,i=``,typeof r==`number`)for(a=0;a<r;a+=1)i+=` `;else typeof r==`string... L139: `,r:`\r`,t:` `},c,l=function(

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/server.jsView on unpkg · L127

bin/commands/agent.mjsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/commands/agent.mjsView on unpkg · L72

bin/build/build.mjsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/build/build.mjsView on unpkg

dist/lib/orchestrator-DKe5ferf.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/lib/orchestrator-DKe5ferf.jsView on unpkg · L22

dist/headless-agent.jsView file

•path = dist/headless-agent.js kind = oversized_source_file sizeBytes = 7111614 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/headless-agent.jsView on unpkg

dist/lib/git-COWGgQY_.jsView file

15651patternName = generic_password severity = medium line = 15651

Medium

Secret Pattern

Hardcoded password in dist/lib/git-COWGgQY_.js

dist/lib/git-COWGgQY_.jsView on unpkg · L15651

src/subsystems/git/git.tsView file

844patternName = generic_password severity = medium line = 844

Medium

Secret Pattern

Hardcoded password in src/subsystems/git/git.ts

src/subsystems/git/git.tsView on unpkg · L844

Findings

2 Critical10 High9 Medium7 Low

CriticalCommand Output Exfiltrationdist/server.js

CriticalTrigger Reachable Dangerous Capabilitydist/server.js

HighChild Processbin/version.mjs

HighShellsrc/server/services/llamafile-manager.ts

HighEvalsrc/components/shadow-claw-file-viewer/iframe-storage-bridge.test.ts

HighCredential Redirect Persistencedist/server.js

HighSandbox Evasion Gated Capabilitybin/commands/agent.mjs

HighCloud Metadata Accessdist/server.js

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/build/build.mjs

HighCross File Remote Execution Contextdist/lib/orchestrator-DKe5ferf.js

HighTrigger Reachable Command Output Exfiltrationdist/server.js

HighSemantic Analysis Limiteddist/electron/main.cjs

MediumSecret Patterndist/lib/bundler-CsL7hHMq.js

MediumDynamic Requirebin/utils/agent-core.mjs

MediumUnsafe Vm Contextsrc/service-worker/patch-service-worker-trusted-types.test.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/headless-agent.js

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/lib/git-COWGgQY_.js

MediumSecret Patternsrc/subsystems/git/git.ts

LowScripts Present

LowWeak Cryptodist/electron/main.cjs

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowCopyleft License

Affected versions and remediation

This report applies to shadow-claw@1.34.2.

See version security history for other recorded verdicts.

Review the evidence and your use of shadow-claw@1.34.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 01:35:24.456Z (UTC).

78%Suspicious

AI assessment confidence

IntentDangerous Capability

TypeAI-agent capability abuse

False-positive riskMedium

Review stagesource_first_review

Firewall policyWarn-only AI-agent capability risk

Package metadata

npm

AuthorKarl Herrick

Maintainerskherrick

Version1.34.2

Latest on npm1.49.0

PublishedSep 14, 2026

LicenseAGPL-3.0

Dependencies33

Integrityverified

Package size22.3 MB

Files2,475

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/electron/main.cjsexports mapbin → shadow-claw, shadowclaw

Runtimenode >=24

Artifact83.0 MB · 2,475 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: assert:version, build, build:clean, build:copy:all:assets +8

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocketHighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStringsCopyleftLicense