中文導讀（編輯整理）
辨識到實質的驗簽安裝與 HTTP 防護，但敏感資料存取、遠端控制與網站用戶端信任仍有實質風險；未證實特定可利用漏洞，也未給予安全認證。
實際閱讀範圍：固定 README、安裝、HTTP gate／auth 與資料邊界文件；目錄／API 與安全網站讀取失敗，但可讀部分原始檔。
這是固定來源 fcc905914 與 v2.1.3 發行頁 的有限公開網路審查，不是安全證書。未執行安裝、攻擊測試或二進位驗證，也未檢查私有 Cloud 正式部署。公開目錄／資產讀取部分失敗；Claude 的網頁擷取可能只提供摘要。未閱讀的機制或推測不能當成已確認漏洞。
固定來源的 README 當時仍選 v2.1.2，這是審查當時的真實觀察；後來主線 9e5a7ad 已改為 v2.1.3。本輪未審查 Swift 原生配對橋，不能用它宣稱先前 2.1.1 專項報告的疑慮已解決。上一輪 v2.1.2 回覆保留供對照。
方法：只給公開來源／發行網址與問題，停用儲存庫脈絡；可見工具紀錄僅有網路讀取。Codex 首次因工具未提供網路而技術失敗，排除比較後各重試一次；有效回覆完整保留，包括原文的狀態結尾，不宣稱所有內建指令均已移除。完整方法紀錄。
下載完整英文原文 · SHA-256 710bfd09ef4a84c6ab00ebab907728aafd483d2fcf5dd69605fc28f13f445ea0
完整英文原始回覆（未翻譯）
Yes—there is meaningful security risk. Treat Clawdline as a remote-control tool with access to your development environment, not merely a session viewer. I found security safeguards in the sampled source, but cannot certify v2.1.3 as safe.
Main risks
- Sensitive-data access and command execution. It reads agent conversations, project files and terminal content; paired browsers can send instructions and use terminals. Compromise of an authorized endpoint could therefore expose secrets or execute commands with your user’s permissions. Pinned README
- Cloud encryption does not remove endpoint trust. The project explicitly notes that malicious browser-delivered application code could disclose plaintext after decryption. Its inventory also identifies traffic metadata, notification-display exposure and network-address disclosure during direct-connection negotiation. That inventory covers an earlier revision, so it is not complete verification of v2.1.3. Data boundaries
- Installer and publisher trust remain necessary. Signing authenticates a publisher’s release; it does not establish that its code is harmless. The installer ultimately executes the downloaded program’s setup routine. Installer source
Positive evidence
The sampled installer verifies an Ed25519-signed manifest using a pinned key, then checks the archive’s size and SHA-256 before extraction or execution. It also checks an explicitly requested version. These are substantive supply-chain protections. Installer source
The HTTP gate implements token authentication, same-origin checks for changes and capability checks. Pairing-code access and device management require the machine’s local credential. This is evidence of defensive implementation—not proof that every route is secure. HTTP gate, authentication handlers
My recommendation
Test it first in a separate OS account or disposable environment without production credentials. Keep Cloud and terminal integration disabled until needed; pair only trusted devices, avoid public port exposure, and do not bypass Gatekeeper.
For v2.1.3, verify the actual download’s signature, provenance and source revision before running it. The release advertises a signed/notarized DMG, but I did not independently verify that artifact. Also, the README at your specified commit still directs installation to v2.1.2, so its copy-paste command does not install the release you asked about. v2.1.3 release, pinned installation instructions
Reading limitations: This was a limited public-source review, not a full audit. The GitHub tree/API and security website were inaccessible through the available reader; selected raw source files were accessible. I did not install or execute the tool, audit all dependencies, test exploits, verify release binaries, or inspect the private Cloud deployment. I did not establish a specific exploitable vulnerability, but that is not a clean bill of health.
Fixed but not yet released (awaiting review): Nothing.