shellward 0.5.10 → 0.5.11

package/dist/commands/check-updates.js

@@ -0,0 +1,166 @@
+// src/commands/check-updates.ts — /check-updates: check versions + remote vulnerability DB
+import { execSync } from 'child_process';
+import { existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+import { resolveLocale } from '../types.js';
+import { checkForUpdate, fetchVulnDB, compareVersions } from '../update-check.js';
+// Local fallback vulnerability database (used when remote fetch fails)
+// Contains only CVE-assigned vulnerabilities as minimum baseline
+const LOCAL_VULNS = [
+    {
+        affectedBelow: '1.0.111',
+        severity: 'HIGH',
+        id: 'CVE-2025-59536',
+        description_zh: '远程代码执行：恶意仓库通过 Hooks 和 MCP Server 在信任提示前执行任意命令 (CVSS 8.7)',
+        description_en: 'RCE via Hooks and MCP Server bypass — arbitrary shell execution before trust dialog (CVSS 8.7)',
+    },
+    {
+        affectedBelow: '2.0.65',
+        severity: 'MEDIUM',
+        id: 'CVE-2026-21852',
+        description_zh: 'API 密钥泄露：恶意仓库通过 settings.json 设置 ANTHROPIC_BASE_URL 窃取用户 API Key (CVSS 5.3)',
+        description_en: 'API key exfiltration via ANTHROPIC_BASE_URL in settings.json before trust prompt (CVSS 5.3)',
+    },
+    {
+        affectedBelow: '2026.2.7',
+        severity: 'HIGH',
+        id: 'GHSA-ff64-7w26-62rf',
+        description_zh: '沙箱逃逸：通过 settings.json 持久化配置注入',
+        description_en: 'Sandbox escape via persistent configuration injection in settings.json',
+    },
+];
+export function registerCheckUpdatesCommand(api, config) {
+    const locale = resolveLocale(config);
+    api.registerCommand({
+        name: 'check-updates',
+        description: locale === 'zh'
+            ? '🔄 检查版本更新和已知漏洞（支持远程漏洞库）'
+            : '🔄 Check for updates and known vulnerabilities (remote vuln DB)',
+        acceptsArgs: false,
+        handler: async () => {
+            const zh = locale === 'zh';
+            const lines = [];
+            lines.push(zh ? '🔄 **版本与漏洞检查**' : '🔄 **Version & Vulnerability Check**');
+            lines.push('');
+            // 1. Get OpenClaw version
+            let openclawVersion = 'unknown';
+            try {
+                const out = execSync('openclaw --version 2>&1', { timeout: 5000 }).toString().trim();
+                const match = out.match(/(\d{4}\.\d+\.\d+)/);
+                if (match)
+                    openclawVersion = match[1];
+            }
+            catch { /* skip */ }
+            lines.push(zh
+                ? `### OpenClaw 版本: ${openclawVersion}`
+                : `### OpenClaw Version: ${openclawVersion}`);
+            lines.push('');
+            // 2. Check ShellWard version + available update
+            let shellwardVersion = 'unknown';
+            try {
+                const pkgPath = join(__dirname, '../../package.json');
+                if (existsSync(pkgPath)) {
+                    const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+                    shellwardVersion = pkg.version || 'unknown';
+                }
+            }
+            catch { /* skip */ }
+            lines.push(zh
+                ? `### ShellWard 版本: ${shellwardVersion}`
+                : `### ShellWard Version: ${shellwardVersion}`);
+            // Check for ShellWard update from npm
+            try {
+                const updateInfo = await checkForUpdate(shellwardVersion);
+                if (updateInfo?.updateAvailable) {
+                    lines.push(zh
+                        ? `  🆕 **新版本 v${updateInfo.latest} 可用！** 运行 \`openclaw plugins update shellward\` 更新`
+                        : `  🆕 **v${updateInfo.latest} available!** Run \`openclaw plugins update shellward\` to update`);
+                }
+                else if (updateInfo) {
+                    lines.push(zh ? '  ✅ 已是最新版本' : '  ✅ Up to date');
+                }
+            }
+            catch { /* skip */ }
+            lines.push('');
+            // 3. Check known vulnerabilities (remote DB with local fallback)
+            lines.push(zh ? '### 已知漏洞检查' : '### Known Vulnerability Check');
+            let vulnDB = LOCAL_VULNS;
+            let alerts = [];
+            let dbSource = 'local';
+            try {
+                const remote = await fetchVulnDB();
+                if (remote.vulns.length > 0) {
+                    vulnDB = remote.vulns;
+                    dbSource = 'remote';
+                }
+                alerts = remote.alerts || [];
+            }
+            catch { /* use local */ }
+            lines.push(zh
+                ? `  数据源: ${dbSource === 'remote' ? `远程漏洞库 (GitHub) — ${vulnDB.length} 条记录` : '本地内置数据库'}`
+                : `  Source: ${dbSource === 'remote' ? `Remote vuln DB (GitHub) — ${vulnDB.length} entries` : 'Local built-in database'}`);
+            if (openclawVersion === 'unknown') {
+                lines.push(zh
+                    ? '  ⚠️ 无法确定 OpenClaw 版本，请手动检查'
+                    : '  ⚠️ Cannot determine OpenClaw version, please check manually');
+            }
+            else {
+                const affected = vulnDB.filter(v => compareVersions(openclawVersion, v.affectedBelow) < 0);
+                if (affected.length === 0) {
+                    lines.push(zh
+                        ? '  ✅ 当前版本未发现已知漏洞'
+                        : '  ✅ No known vulnerabilities for current version');
+                }
+                else {
+                    for (const vuln of affected) {
+                        const icon = vuln.severity === 'CRITICAL' ? '🔴' : '🟡';
+                        const desc = zh ? vuln.description_zh : vuln.description_en;
+                        lines.push(`  ${icon} **${vuln.id}** [${vuln.severity}]: ${desc}`);
+                        lines.push(zh
+                            ? `     影响版本: < ${vuln.affectedBelow} — 请升级`
+                            : `     Affected: < ${vuln.affectedBelow} — please upgrade`);
+                    }
+                }
+            }
+            // Supply chain alerts
+            if (alerts.length > 0) {
+                lines.push('');
+                lines.push(zh ? '### 供应链安全警告' : '### Supply Chain Alerts');
+                for (const alert of alerts) {
+                    const icon = alert.severity === 'CRITICAL' ? '🔴' : '🟡';
+                    const desc = zh ? alert.description_zh : alert.description_en;
+                    lines.push(`  ${icon} **${alert.id}** [${alert.date}]: ${desc}`);
+                }
+            }
+            lines.push('');
+            // 4. Check Node.js version
+            lines.push(zh ? '### 运行环境' : '### Runtime Environment');
+            try {
+                const nodeVer = process.version;
+                const major = parseInt(nodeVer.slice(1));
+                if (major < 22) {
+                    lines.push(zh
+                        ? `  ⚠️ Node.js ${nodeVer} — OpenClaw 要求 >= 22.12，请升级`
+                        : `  ⚠️ Node.js ${nodeVer} — OpenClaw requires >= 22.12, please upgrade`);
+                }
+                else {
+                    lines.push(zh
+                        ? `  ✅ Node.js ${nodeVer}`
+                        : `  ✅ Node.js ${nodeVer}`);
+                }
+            }
+            catch { /* skip */ }
+            lines.push(`  ${zh ? '平台' : 'Platform'}: ${process.platform} ${process.arch}`);
+            lines.push('');
+            // 5. Recommendations
+            lines.push('---');
+            lines.push(zh
+                ? '💡 **建议**: 定期运行 `/check-updates` 检查，及时升级到最新版本'
+                : '💡 **Tip**: Run `/check-updates` regularly, upgrade to latest versions promptly');
+            lines.push(zh
+                ? '📖 关注 OpenClaw 安全公告: https://github.com/nicepkg/openclaw/security'
+                : '📖 Follow OpenClaw security advisories: https://github.com/nicepkg/openclaw/security');
+            return { text: lines.join('\n') };
+        },
+    });
+}

package/dist/commands/harden.d.ts

@@ -0,0 +1,2 @@
+import type { ShellWardConfig } from '../types.js';
+export declare function registerHardenCommand(api: any, config: ShellWardConfig): void;

package/dist/commands/harden.js

@@ -0,0 +1,218 @@
+// src/commands/harden.ts — /harden command: one-click security hardening
+import { existsSync, statSync, chmodSync, readFileSync } from 'fs';
+import { join } from 'path';
+import { execSync } from 'child_process';
+import { resolveLocale } from '../types.js';
+import { getHomeDir } from '../utils.js';
+const HOME = getHomeDir();
+export function registerHardenCommand(api, config) {
+    const locale = resolveLocale(config);
+    api.registerCommand({
+        name: 'harden',
+        description: locale === 'zh'
+            ? '🔒 一键安全加固 (权限修复、凭证扫描、端口检查)'
+            : '🔒 One-click security hardening (permissions, credentials, ports)',
+        acceptsArgs: true,
+        handler: (ctx) => {
+            const zh = locale === 'zh';
+            const args = (ctx.args || '').trim().toLowerCase();
+            const dryRun = args !== 'fix';
+            const lines = [];
+            const issues = [];
+            const fixed = [];
+            lines.push(zh ? '🔒 **安全加固扫描**' : '🔒 **Security Hardening Scan**');
+            if (dryRun) {
+                lines.push(zh
+                    ? '_(扫描模式 — 使用 `/harden fix` 自动修复)_'
+                    : '_(scan mode — use `/harden fix` to auto-fix)_');
+            }
+            lines.push('');
+            // === 1. File Permission Checks ===
+            lines.push(zh ? '### 文件权限检查' : '### File Permission Checks');
+            const sensitiveFiles = [
+                ['.env', 0o600],
+                ['.env.local', 0o600],
+                ['.env.production', 0o600],
+                ['.ssh/id_rsa', 0o600],
+                ['.ssh/id_ed25519', 0o600],
+                ['.ssh/config', 0o600],
+                ['.aws/credentials', 0o600],
+                ['.npmrc', 0o600],
+                ['.git-credentials', 0o600],
+                ['.openclaw/openclaw.json', 0o600],
+            ];
+            for (const [rel, target] of sensitiveFiles) {
+                const full = join(HOME, rel);
+                if (!existsSync(full))
+                    continue;
+                try {
+                    const stat = statSync(full);
+                    const current = stat.mode & 0o777;
+                    if (current > target) {
+                        const msg = zh
+                            ? `⚠️ ${rel}: 权限 ${current.toString(8)} → 建议 ${target.toString(8)}`
+                            : `⚠️ ${rel}: permissions ${current.toString(8)} → should be ${target.toString(8)}`;
+                        issues.push(msg);
+                        lines.push(`  ${msg}`);
+                        if (!dryRun) {
+                            try {
+                                chmodSync(full, target);
+                                fixed.push(rel);
+                                lines.push(zh ? `    ✅ 已修复` : `    ✅ Fixed`);
+                            }
+                            catch {
+                                lines.push(zh ? `    ❌ 修复失败（权限不足）` : `    ❌ Fix failed (permission denied)`);
+                            }
+                        }
+                    }
+                    else {
+                        lines.push(zh ? `  ✅ ${rel}: ${current.toString(8)}` : `  ✅ ${rel}: ${current.toString(8)}`);
+                    }
+                }
+                catch { /* skip */ }
+            }
+            lines.push('');
+            // === 2. Plaintext Credential Scan ===
+            lines.push(zh ? '### 明文凭证扫描' : '### Plaintext Credential Scan');
+            const credPatterns = [
+                /(?:api[_-]?key|api[_-]?token|access[_-]?token)\s*[=:]\s*['"]?[A-Za-z0-9_\-]{20,}/i,
+                /sk-[a-zA-Z0-9]{20,}/,
+                /AKIA[0-9A-Z]{16}/,
+                /ghp_[A-Za-z0-9_]{36,}/,
+                /password\s*[=:]\s*['"]?\S{6,}/i,
+            ];
+            const envFiles = ['.env', '.env.local', '.env.production', '.bashrc', '.zshrc', '.bash_profile'];
+            let credFound = 0;
+            for (const rel of envFiles) {
+                const full = join(HOME, rel);
+                if (!existsSync(full))
+                    continue;
+                try {
+                    const content = readFileSync(full, 'utf-8');
+                    for (const pat of credPatterns) {
+                        if (pat.test(content)) {
+                            credFound++;
+                            const msg = zh
+                                ? `⚠️ ${rel}: 发现明文凭证（建议使用密钥管理工具）`
+                                : `⚠️ ${rel}: plaintext credentials found (use a secret manager)`;
+                            issues.push(msg);
+                            lines.push(`  ${msg}`);
+                            break;
+                        }
+                    }
+                }
+                catch { /* skip */ }
+            }
+            if (credFound === 0) {
+                lines.push(zh ? '  ✅ 未发现明文凭证' : '  ✅ No plaintext credentials found');
+            }
+            lines.push('');
+            // === 3. Network Exposure ===
+            lines.push(zh ? '### 网络暴露检查' : '### Network Exposure Check');
+            try {
+                const listening = execSync('ss -tlnp 2>/dev/null || netstat -tlnp 2>/dev/null', { timeout: 5000 }).toString();
+                const dangerPorts = [
+                    ['19000', 'OpenClaw Gateway'],
+                    ['19001', 'OpenClaw Dev'],
+                    ['3000', 'Dev Server'],
+                    ['8080', 'HTTP Alt'],
+                    ['5432', 'PostgreSQL'],
+                    ['3306', 'MySQL'],
+                    ['6379', 'Redis'],
+                    ['27017', 'MongoDB'],
+                ];
+                let portIssues = 0;
+                for (const [port, name] of dangerPorts) {
+                    // Check if listening on 0.0.0.0 (all interfaces)
+                    const allInterfaces = listening.includes(`0.0.0.0:${port}`) || listening.includes(`:::${port}`);
+                    if (allInterfaces) {
+                        portIssues++;
+                        const msg = zh
+                            ? `⚠️ ${name} (${port}) 监听在所有接口 — 建议绑定 127.0.0.1`
+                            : `⚠️ ${name} (${port}) listening on all interfaces — bind to 127.0.0.1`;
+                        issues.push(msg);
+                        lines.push(`  ${msg}`);
+                    }
+                }
+                if (portIssues === 0) {
+                    lines.push(zh ? '  ✅ 未发现危险端口暴露' : '  ✅ No dangerous port exposure detected');
+                }
+            }
+            catch {
+                lines.push(zh ? '  ℹ️ 无法检查网络状态' : '  ℹ️ Cannot check network status');
+            }
+            lines.push('');
+            // === 4. Running as root ===
+            lines.push(zh ? '### 运行权限' : '### Runtime Privileges');
+            if (process.getuid && process.getuid() === 0) {
+                const msg = zh
+                    ? '⚠️ 以 root 身份运行 — 强烈建议使用普通用户 + 容器隔离'
+                    : '⚠️ Running as root — strongly recommend non-root user + container isolation';
+                issues.push(msg);
+                lines.push(`  ${msg}`);
+            }
+            else {
+                lines.push(zh ? '  ✅ 非 root 运行' : '  ✅ Not running as root');
+            }
+            // Check if Docker available
+            try {
+                execSync('which docker 2>/dev/null', { timeout: 3000 });
+                lines.push(zh ? '  ✅ Docker 可用（可用于容器隔离）' : '  ✅ Docker available (for container isolation)');
+            }
+            catch {
+                lines.push(zh ? '  ℹ️ Docker 未安装（建议安装以支持容器隔离）' : '  ℹ️ Docker not installed (recommended for isolation)');
+            }
+            lines.push('');
+            // === 5. One-click scripts ===
+            lines.push(zh ? '### 一键安全脚本' : '### One-click Security Scripts');
+            // Dockerfile
+            lines.push(zh ? '**容器隔离** — 复制以下 Dockerfile:' : '**Container isolation** — copy this Dockerfile:');
+            lines.push('```dockerfile');
+            lines.push('FROM node:22-slim');
+            lines.push('RUN useradd -m -s /bin/bash openclaw');
+            lines.push('USER openclaw');
+            lines.push('WORKDIR /home/openclaw');
+            lines.push('RUN npm install -g openclaw');
+            lines.push('COPY .env .env');
+            lines.push('EXPOSE 19000');
+            lines.push('CMD ["openclaw", "agent", "--local"]');
+            lines.push('```');
+            lines.push(zh
+                ? '运行: `docker build -t openclaw-safe . && docker run --rm -it openclaw-safe`'
+                : 'Run: `docker build -t openclaw-safe . && docker run --rm -it openclaw-safe`');
+            lines.push('');
+            // Firewall
+            lines.push(zh ? '**防火墙限制** — 仅允许必要出站:' : '**Firewall** — allow only necessary outbound:');
+            lines.push('```bash');
+            lines.push(zh ? '# 只允许 HTTPS 出站（API 调用），禁止其他出站' : '# Allow only HTTPS outbound (API calls), block everything else');
+            lines.push('sudo iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT');
+            lines.push('sudo iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT');
+            lines.push('sudo iptables -A OUTPUT -p udp --dport 53 -j ACCEPT  # DNS');
+            lines.push('sudo iptables -A OUTPUT -o lo -j ACCEPT               # localhost');
+            lines.push('sudo iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT');
+            lines.push('sudo iptables -A OUTPUT -j LOG --log-prefix "BLOCKED: "');
+            lines.push('sudo iptables -A OUTPUT -j DROP');
+            lines.push('```');
+            lines.push(zh
+                ? '⚠️ 执行前请确认不会影响其他服务'
+                : '⚠️ Review before applying — may affect other services');
+            lines.push('');
+            // === Summary ===
+            lines.push('---');
+            if (issues.length === 0) {
+                lines.push(zh ? '✅ **安全检查通过！未发现问题。**' : '✅ **All checks passed! No issues found.**');
+            }
+            else {
+                lines.push(zh
+                    ? `⚠️ **发现 ${issues.length} 个安全问题**${fixed.length > 0 ? `，已自动修复 ${fixed.length} 个` : ''}`
+                    : `⚠️ **Found ${issues.length} security issues**${fixed.length > 0 ? `, auto-fixed ${fixed.length}` : ''}`);
+                if (dryRun && issues.some(i => i.includes('权限') || i.includes('permissions'))) {
+                    lines.push(zh
+                        ? '💡 使用 `/harden fix` 自动修复文件权限问题'
+                        : '💡 Use `/harden fix` to auto-fix file permission issues');
+                }
+            }
+            return { text: lines.join('\n') };
+        },
+    });
+}

package/dist/commands/index.d.ts

@@ -0,0 +1,2 @@
+import type { ShellWardConfig } from '../types.js';
+export declare function registerAllCommands(api: any, config: ShellWardConfig): void;

package/dist/commands/index.js

@@ -0,0 +1,56 @@
+// src/commands/index.ts — Register all ShellWard commands
+import { resolveLocale } from '../types.js';
+import { registerSecurityCommand } from './security.js';
+import { registerAuditCommand } from './audit.js';
+import { registerHardenCommand } from './harden.js';
+import { registerScanPluginsCommand } from './scan-plugins.js';
+import { registerCheckUpdatesCommand } from './check-updates.js';
+import { registerUpgradeOpenClawCommand } from './upgrade-openclaw.js';
+export function registerAllCommands(api, config) {
+    const locale = resolveLocale(config);
+    // Register individual commands
+    registerSecurityCommand(api, config);
+    registerAuditCommand(api, config);
+    registerHardenCommand(api, config);
+    registerScanPluginsCommand(api, config);
+    registerCheckUpdatesCommand(api, config);
+    registerUpgradeOpenClawCommand(api, config);
+    // Register /cg shortcut with help
+    api.registerCommand({
+        name: 'cg',
+        description: locale === 'zh'
+            ? '🛡️ ShellWard 安全命令帮助'
+            : '🛡️ ShellWard security command help',
+        acceptsArgs: false,
+        handler: () => ({
+            text: locale === 'zh' ? `🛡️ **ShellWard 快捷命令**
+
+| 命令 | 说明 |
+|------|------|
+| \`/security\` | 安全状态总览（防御层、审计统计、系统检查） |
+| \`/audit [数量] [过滤]\` | 查看审计日志 (过滤: block/audit/critical/high) |
+| \`/harden\` | 安全扫描 · \`/harden fix\` 自动修复权限 |
+| \`/scan-plugins\` | 扫描已安装插件的安全风险 |
+| \`/check-updates\` | 检查 OpenClaw 版本和已知漏洞 |
+| \`/upgrade-openclaw\` | 一键升级 OpenClaw · \`/upgrade-openclaw yes\` 直接执行 |
+
+**当前防御层 (8层):**
+L1 提示注入 · L2 输出审计 · L3 工具拦截 · L4 注入检测
+L5 安全门 · L6 回复审计 · L7 数据流监控 · L8 会话安全`
+                : `🛡️ **ShellWard Quick Commands**
+
+| Command | Description |
+|---------|-------------|
+| \`/security\` | Security status overview (layers, audit stats, system checks) |
+| \`/audit [count] [filter]\` | View audit log (filter: block/audit/critical/high) |
+| \`/harden\` | Security scan · \`/harden fix\` to auto-fix permissions |
+| \`/scan-plugins\` | Scan installed plugins for security risks |
+| \`/check-updates\` | Check OpenClaw version and known vulnerabilities |
+| \`/upgrade-openclaw\` | Upgrade OpenClaw · \`/upgrade-openclaw yes\` to execute |
+
+**Active Defense Layers (8):**
+L1 Prompt Guard · L2 Output Scanner · L3 Tool Blocker · L4 Input Auditor
+L5 Security Gate · L6 Outbound Guard · L7 Data Flow Guard · L8 Session Guard`,
+        }),
+    });
+}

package/dist/commands/scan-plugins.d.ts

@@ -0,0 +1,2 @@
+import type { ShellWardConfig } from '../types.js';
+export declare function registerScanPluginsCommand(api: any, config: ShellWardConfig): void;

package/dist/commands/scan-plugins.js

@@ -0,0 +1,186 @@
+// src/commands/scan-plugins.ts — /scan-plugins: scan installed plugins for security risks
+import { existsSync, readFileSync, readdirSync, statSync } from 'fs';
+import { join } from 'path';
+import { resolveLocale } from '../types.js';
+import { getHomeDir } from '../utils.js';
+const HOME = getHomeDir();
+const OPENCLAW_DIR = join(HOME, '.openclaw');
+// Known suspicious patterns in plugin code
+const SUSPICIOUS_PATTERNS = [
+    { pattern: /eval\s*\(/, name: 'eval()', risk: 'code injection' },
+    { pattern: /child_process|execSync|spawnSync|exec\(/, name: 'shell exec', risk: 'command execution' },
+    { pattern: /\/dev\/tcp|nc\s+-e|ncat/, name: 'reverse shell', risk: 'remote access' },
+    { pattern: /fetch\s*\([^)]*(?:webhook|exfil|callback)/, name: 'data exfiltration', risk: 'data leak' },
+    { pattern: /process\.env\.[A-Z_]*(?:KEY|TOKEN|SECRET|PASSWORD)/i, name: 'env secret access', risk: 'credential access' },
+    { pattern: /writeFileSync.*(?:\.ssh|\.env|\.aws|\.npmrc)/, name: 'sensitive file write', risk: 'credential tampering' },
+    { pattern: /crypto\.createHash|Buffer\.from.*base64/, name: 'crypto/encoding', risk: 'possible obfuscation' },
+    { pattern: /https?:\/\/(?!(?:github\.com|npmjs\.com|registry\.npmjs\.org))[^\s'"]+/g, name: 'external URL', risk: 'data exfiltration' },
+];
+export function registerScanPluginsCommand(api, config) {
+    const locale = resolveLocale(config);
+    api.registerCommand({
+        name: 'scan-plugins',
+        description: locale === 'zh'
+            ? '🔍 扫描已安装插件的安全风险'
+            : '🔍 Scan installed plugins for security risks',
+        acceptsArgs: false,
+        handler: () => {
+            const zh = locale === 'zh';
+            const lines = [];
+            lines.push(zh ? '🔍 **插件安全扫描报告**' : '🔍 **Plugin Security Scan Report**');
+            lines.push('');
+            // Find installed plugins
+            const pluginDirs = [];
+            // Check global extensions
+            const extensionsDir = join(OPENCLAW_DIR, 'extensions');
+            if (existsSync(extensionsDir)) {
+                try {
+                    for (const name of readdirSync(extensionsDir)) {
+                        const p = join(extensionsDir, name);
+                        if (statSync(p).isDirectory()) {
+                            pluginDirs.push({ name, path: p });
+                        }
+                    }
+                }
+                catch { /* skip */ }
+            }
+            // Check linked plugins
+            const pluginsDir = join(OPENCLAW_DIR, 'plugins');
+            if (existsSync(pluginsDir)) {
+                try {
+                    for (const name of readdirSync(pluginsDir)) {
+                        const p = join(pluginsDir, name);
+                        pluginDirs.push({ name, path: p });
+                    }
+                }
+                catch { /* skip */ }
+            }
+            if (pluginDirs.length === 0) {
+                lines.push(zh ? 'ℹ️ 未发现已安装的第三方插件。' : 'ℹ️ No third-party plugins found.');
+                return { text: lines.join('\n') };
+            }
+            lines.push(zh
+                ? `${zh ? '发现' : 'Found'} ${pluginDirs.length} ${zh ? '个插件' : 'plugins'}`
+                : `Found ${pluginDirs.length} plugins`);
+            lines.push('');
+            let totalRisks = 0;
+            const riskyPluginNames = new Set();
+            for (const plugin of pluginDirs) {
+                const risks = [];
+                // 1. Check for package.json
+                const pkgPath = join(plugin.path, 'package.json');
+                let pkg = null;
+                if (existsSync(pkgPath)) {
+                    try {
+                        pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+                    }
+                    catch { /* skip */ }
+                }
+                // 2. Check dependencies count (more deps = more supply chain risk)
+                if (pkg) {
+                    const depCount = Object.keys(pkg.dependencies || {}).length;
+                    if (depCount > 20) {
+                        risks.push(zh
+                            ? `⚠️ 依赖过多 (${depCount} 个) — 供应链攻击风险`
+                            : `⚠️ Too many deps (${depCount}) — supply chain risk`);
+                    }
+                    // Check for suspicious scripts
+                    const scripts = pkg.scripts || {};
+                    for (const [key, val] of Object.entries(scripts)) {
+                        if (/curl|wget|eval|nc\s/.test(String(val))) {
+                            risks.push(zh
+                                ? `🔴 可疑脚本: scripts.${key}`
+                                : `🔴 Suspicious script: scripts.${key}`);
+                        }
+                    }
+                }
+                // 3. Scan source files for suspicious patterns
+                const srcFiles = collectSourceFiles(plugin.path, 3); // max depth 3
+                for (const file of srcFiles) {
+                    try {
+                        const content = readFileSync(file, 'utf-8');
+                        for (const rule of SUSPICIOUS_PATTERNS) {
+                            // Use fresh regex to avoid lastIndex state issues with global patterns
+                            const regex = new RegExp(rule.pattern.source, rule.pattern.flags);
+                            if (regex.test(content)) {
+                                const relPath = file.replace(plugin.path + '/', '');
+                                risks.push(zh
+                                    ? `⚠️ ${relPath}: ${rule.name} (${rule.risk})`
+                                    : `⚠️ ${relPath}: ${rule.name} (${rule.risk})`);
+                            }
+                        }
+                    }
+                    catch { /* skip */ }
+                }
+                // 4. Check if plugin has signature/checksum
+                const hasSignature = existsSync(join(plugin.path, 'SIGNATURE')) || existsSync(join(plugin.path, '.signature'));
+                if (!hasSignature) {
+                    risks.push(zh ? 'ℹ️ 无签名验证文件' : 'ℹ️ No signature file');
+                }
+                // Output plugin report
+                const icon = risks.filter(r => r.startsWith('🔴')).length > 0 ? '🔴'
+                    : risks.filter(r => r.startsWith('⚠️')).length > 0 ? '⚠️' : '✅';
+                lines.push(`### ${icon} ${plugin.name}`);
+                if (pkg) {
+                    lines.push(`  v${pkg.version || '?'} | ${pkg.author || 'unknown author'} | ${Object.keys(pkg.dependencies || {}).length} deps`);
+                }
+                if (risks.length === 0) {
+                    lines.push(zh ? '  ✅ 未发现安全风险' : '  ✅ No security risks found');
+                }
+                else {
+                    for (const risk of risks) {
+                        lines.push(`  ${risk}`);
+                        totalRisks++;
+                    }
+                    if (risks.some(r => r.startsWith('🔴') || (r.startsWith('⚠️') && !r.includes('签名') && !r.includes('signature') && !r.includes('依赖') && !r.includes('deps')))) {
+                        riskyPluginNames.add(plugin.name);
+                    }
+                }
+                lines.push('');
+            }
+            // Summary + removal commands
+            lines.push('---');
+            if (totalRisks === 0) {
+                lines.push(zh ? '✅ **所有插件扫描通过**' : '✅ **All plugins passed scan**');
+            }
+            else {
+                lines.push(zh
+                    ? `⚠️ **发现 ${totalRisks} 个潜在风险** — 请审查标记的插件`
+                    : `⚠️ **${totalRisks} potential risks found** — review flagged plugins`);
+                if (riskyPluginNames.size > 0) {
+                    lines.push('');
+                    lines.push(zh ? '**一键移除高风险插件** — 复制执行:' : '**Remove risky plugins** — copy & run:');
+                    lines.push('```bash');
+                    for (const name of riskyPluginNames) {
+                        lines.push(`openclaw plugins uninstall ${name}`);
+                    }
+                    lines.push('```');
+                }
+                lines.push(zh
+                    ? '💡 建议: 仅从可信渠道安装插件，定期运行 `/scan-plugins` 检查'
+                    : '💡 Tip: Only install plugins from trusted sources, run `/scan-plugins` regularly');
+            }
+            return { text: lines.join('\n') };
+        },
+    });
+}
+function collectSourceFiles(dir, maxDepth, depth = 0) {
+    if (depth > maxDepth)
+        return [];
+    const files = [];
+    try {
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            if (entry.name === 'node_modules' || entry.name === '.git' || entry.name === 'dist')
+                continue;
+            const full = join(dir, entry.name);
+            if (entry.isDirectory()) {
+                files.push(...collectSourceFiles(full, maxDepth, depth + 1));
+            }
+            else if (/\.(ts|js|mjs|cjs)$/.test(entry.name)) {
+                files.push(full);
+            }
+        }
+    }
+    catch { /* skip */ }
+    return files;
+}

package/dist/commands/security.d.ts

@@ -0,0 +1,2 @@
+import type { ShellWardConfig } from '../types.js';
+export declare function registerSecurityCommand(api: any, config: ShellWardConfig): void;