← 回到四專案比較

獨立審查 · 完整回覆

Clawdline v2.1.2

Clawdline v2.1.2 · Claude Code · 一般詢問

2026-10-22239adc8ad ↗僅讀公開網路

確切題目

Is there a security risk in installing this tool?
題目附帶的固定版本連結 ↗

下方完整保留 agent 原始回覆，原文語言有明確標示。中文導讀是編輯整理，不是原文，也不是驗證結論。審查沒有執行安裝或攻擊測試。

中文導讀（編輯整理）

未報告安裝程式或發行資產警訊；提醒配對裝置權限、發布者與本機工具信任。未檢查本機認證。

實際閱讀範圍：安裝程式、發行 metadata／雜湊及文件；未執行二進位檔或閱讀本機認證。

審查另附的 v2.1.2 發行頁

這份回覆針對固定來源 239adc8ad 與 v2.1.2。該來源的 README 仍寫 v2.1.1，後來主線已改為 v2.1.2；這不代表 v2.1.2 發行檔缺失。閱讀者未追蹤的認證／換鑰接線，不等於已證實該機制不存在。

審查者在回覆中自行假設提問者擁有此程式庫；題目沒有提供這個身分。這個假設原文保留，本次不能視為嚴格盲測。

下載完整英文原文 · SHA-256 ad40be20b67ab878ebba905827d08a034742043d63c9ecd788d4926cb3c0de49

完整英文原始回覆（未翻譯）

I didn’t find any red flags in the installer or the release artifacts. The real risk is in what the tool does by design: it’s a daemon that can read your agent sessions and run commands on your machine. Here’s what I checked through GitHub. I didn’t execute or inspect any binaries.

Release integrity (looks sound)

  • v2.1.2 was built and published by github-actions[bot] from commit 239adc8, the same commit you linked.
  • Checksums: the five archive hashes in SHA256SUMS match the SHA-256 digests GitHub records for each asset, and the signed manifest.json lists the same five artifacts.
  • install.sh at 239adc8:
    • No sudo, no eval, no piping remote content into a shell, no shell rc/PATH edits, no telemetry.
    • It checks manifest.json against a hardcoded Ed25519 key (2Du3yZ4j…/O0=) using local OpenSSL 3. It only reads the manifest after that check passes.
    • It then checks the archive’s exact size and SHA-256 before unpacking. HTTPS is required and downgrade redirects are refused.
  • Not verified by me: I couldn’t run the Ed25519 signature check here. If you want that confirmed, run openssl pkeyutl -verify yourself, or just let the installer fail closed.

Gaps and caveats

  1. clawdline setup runs right after the hash check. It installs the per-user service and does the rest of the setup, and it’s inside the binary, so you can’t review it as a script.
  2. The installer trusts whatever openssl it finds. CLAWDLINE_INSTALL_OPENSSL or the first openssl on PATH acts as the verifier. That only matters if something already controls your environment, but a fake binary could approve anything.
  3. fetch() is looser than the main downloader. Its curl allows http to any host, and the wget fallback has no scheme check. It’s only used for --channel beta tag lookup, and the signature check still applies afterward. Minor.
  4. The README is behind the release. It pins install.sh at 74fc07e with --version v2.1.1, so following it installs 2.1.1, not 2.1.2. The trusted key is the same in both versions.
  5. There’s no backup signing key. A code comment says key rotation ships both keys, but only one is pinned.

The main risk: what the tool does

  • It reads Claude Code and Codex transcripts, terminal screens and project files, and serves them on a loopback web console.
  • Paired browsers or phones can send instructions and use terminals, which means running code as you. Revoking a pairing can’t take back content already read.
  • Update checks contact GitHub even with Cloud off. Cloud is off by default. When on, it relays end-to-end encrypted content, but the service still sees account, device and timing metadata.
  • The project’s own docs say an independent security review hasn’t been done, and they don’t defend against malicious same-user processes or symlink/hard-link races.
  • I couldn’t check the current Go daemon’s local auth (loopback tokens, Origin checks, DNS-rebinding defenses). The only trust-boundary doc I found describes the retired Swift design. This is the most important thing to confirm before trusting it. If those defenses are weak, any web page you visit could try to reach the console and the terminals behind it.
  • It’s a 1-star repo with 4,000+ commits and no outside review.

Bottom line: installing it is about as safe as most signed-installer tools, and nothing looked malicious. Running it means trusting a young, unaudited daemon with access to everything your agents can see and do. If you use it, keep Cloud off until you need it, pair only devices you control, and check the daemon’s auth on localhost first.

Since you own this repo: the README version and the missing backup key are quick fixes. Writing a current doc on the daemon’s local auth would also answer the biggest open question.

Sources:

← 回到比較表