← 回到四專案比較

獨立審查 · 完整回覆

Clawdline v2.1.3

Clawdline v2.1.3 · Claude Code · 一般詢問

2026-10-22fcc905914 ↗僅讀公開網路

確切題目

Is there a security risk in installing this tool?
題目附帶的固定版本連結 ↗

下方完整保留 agent 原始回覆，原文語言有明確標示。中文導讀是編輯整理，不是原文，也不是驗證結論。審查沒有執行安裝或攻擊測試。

中文導讀（編輯整理）

未報告惡意跡象，辨識到驗簽安裝；提醒遠端權限、網站程式碼信任與發行流程弱點。未驗證實際發行資產與本機認證。

實際閱讀範圍：透過網頁讀取安裝程式、發行流程／中繼資料、固定金鑰來源與公開安全／貢獻文件；未審查 setup 或執行檔。

這是固定來源 fcc905914 與 v2.1.3 發行頁 的有限公開網路審查，不是安全證書。未執行安裝、攻擊測試或二進位驗證，也未檢查私有 Cloud 正式部署。公開目錄／資產讀取部分失敗；Claude 的網頁擷取可能只提供摘要。未閱讀的機制或推測不能當成已確認漏洞。

固定來源的 README 當時仍選 v2.1.2，這是審查當時的真實觀察；後來主線 9e5a7ad 已改為 v2.1.3。本輪未審查 Swift 原生配對橋，不能用它宣稱先前 2.1.1 專項報告的疑慮已解決。上一輪 v2.1.2 回覆保留供對照。

方法：只給公開來源／發行網址與問題，停用儲存庫脈絡；可見工具紀錄僅有網路讀取。Codex 首次因工具未提供網路而技術失敗，排除比較後各重試一次；有效回覆完整保留，包括原文的狀態結尾，不宣稱所有內建指令均已移除。完整方法紀錄。

下載完整英文原文 · SHA-256 ff54fc0e6108e2743c92c6873d1e0bb3fb4b12b719a91e9b3b36f01f866a9bdf

完整英文原始回覆（未翻譯）

I found no sign that this is malicious and no published advisories for it. The installer is better built than most curl | sh installers. But installing it does carry real risk, mostly because of what the tool is meant to do, not because of hidden behaviour. This review is based on docs and selected files, not a full code audit.

What checks out

  • Signed downloads: install.sh at commit fcc9059 checks the release manifest’s Ed25519 signature against a key written into the script, using your local OpenSSL 3. Only after that does it check the archive’s size and SHA-256, then unpack it and run it. It never skips verification if a check fails.
  • Matching keys: the key in the installer (2Du3yZ4j…/O0=) is the same as the one in internal/adapters/release/keys.go.
  • Nothing unusual in the installer: no sudo, no eval, no changes to your shell startup files, and no other remote scripts are run. It installs under ~/.local/share/clawdline-next.
  • Release process: releases can only be started by hand from main, they pass through a release environment that holds the signing secrets, and they’re created as drafts first. The v2.1.3 tag points to fcc9059, the commit you linked.
  • No agent-targeted tricks: CLAUDE.md and AGENTS.md are ordinary contributor guides with no hidden instructions aimed at AI agents.

Risks to weigh

  1. It’s a remote-control tool by design. It reads your Claude Code and Codex conversations, terminals and project files. Paired browsers or phones with “operating” permission can send instructions and use the terminal. Anyone who compromises a paired device, or the pairing step, effectively gets code execution on your machine.
  2. Cloud (optional, off by default): content is end-to-end encrypted with AES-256-GCM and signed with Ed25519. But the Cloud service delivers the browser’s JavaScript, so a compromised Cloud deployment could read your decrypted content. Cloud also sees metadata (account, devices, connection times, byte counts). Revoking a device doesn’t take back anything it already read.
  3. The trust anchor is the installer itself. The signature check is only as trustworthy as the copy of install.sh you run. The README pins it to a commit (74fc07e), which helps. The URL in the script’s own header points to main, which can change, so don’t use that one.
  4. Most of the setup isn’t in the script. Background services, tmux and the app are installed by the downloaded binary’s clawdline setup command, and I didn’t review that code.
  5. Release signing setup: most GitHub Actions in the release workflow are pinned to version tags rather than exact commits. The macOS signing certificate and notary key are also exposed to the whole build step. Both are moderate supply-chain weaknesses.
  6. No independent security audit, as the project states itself.

What I couldn’t verify

  • Whether the daemon on port 7727 listens only on your own machine (loopback) or on your network, and how its local API is authenticated.
  • The v2.1.3 release files and checksums (the asset list didn’t load), and the claim that the DMG is signed and notarized.
  • That the GitHub approval gate on releases and the branch protection on main are actually turned on (both are repo settings, not visible in code).
  • Which version the README’s install command installs. The README at the v2.1.3 commit still pins v2.1.2. To get v2.1.3 you’d change --version, while keeping the reviewed script commit.
  • The code for setup, the Cloud relay, pairing, and the web console, and the private Cloud service’s infrastructure.

Recommendation: it’s reasonable to install for local use if you accept that it reads and can act on your agent sessions. Use the pinned-commit install command, leave Cloud and direct mode off unless you need them, and pair only devices you control. Before trusting it on a shared network, run lsof -iTCP:7727 -sTCP:LISTEN after installing and confirm it shows 127.0.0.1, not * or 0.0.0.0.

Sources:

← 回到比較表