ClawHub
Back to skill

Security audit

Codex Claw

Security checks for vulnerabilities and agentic risk

Overview

This setup guide is purpose-aligned, but it should be reviewed because it installs and enables an external Codex hook plugin using mutable and forced install steps.

Before installing, confirm you trust the exact @openclaw/codex-claw package version, verify the package before installation, avoid forced or wildcard installs where possible, and review AGENTS.md and SOUL.md for secrets or unsafe instructions because the plugin is designed to load them into future Codex sessions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:39
Finding

Unpinned and Unverified Third-Party Plugin Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39–48 and 164–166
Vulnerability Type: Supply-chain exposure through mutable, insufficiently verified dependencies
Risk Level: Medium

Vulnerable Code Snippets

Primary installation path:

bash
openclaw plugins install clawhub:@openclaw/codex-claw

Fallback installation path:

bash
clawhub package download @openclaw/codex-claw --version latest -o /tmp/codex-claw --force
openclaw plugins install /tmp/codex-claw/openclaw-codex-claw-*.tgz --force

A verification command appears later in the document but is not required before the earlier installation:

bash
clawhub package download @openclaw/codex-claw --version latest -o /tmp/codex-claw --force
clawhub package verify /tmp/codex-claw/openclaw-codex-claw-*.tgz --package @openclaw/codex-claw --version latest
tar -tzf /tmp/codex-claw/openclaw-codex-claw-*.tgz | sort

Technical Analysis

The installation instructions select the mutable latest release rather than an immutable version and digest. The fallback procedure installs the downloaded archive before requiring package verification. Both download and installation use --force, which can overwrite existing files or state, while the archive is selected with a wildcard rather than an exact verified filename.

Consequently, the code ultimately executed is determined by the upstream package state at installation time rather than by the audited Skill content. The project contains only SKILL.md; the referenced plugin runtime is not bundled and therefore could not be statically reviewed in this audit.

The later package verify command partially mitigates package-identity concerns when users voluntarily run it, but it is presented as part of a display-caveat investigation rather than as a mandatory prerequisite to installation. It also continues to reference the mutable latest version.

Attack Path

  1. An attacker compromises the upstream package, maintainer accou ...[truncated 1409 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an exact, reviewed version rather than latest.
  2. Publish and require a trusted SHA-256 digest or signed provenance record for the precise archive.
  3. Change the workflow so verification occurs before installation:
    • Download the pinned release.
    • Verify package identity, version, signature, and digest.
    • Inspect the archive manifest.
    • Install only after every check succeeds.
  4. Download into a newly created, permission-restricted directory and use one exact archive filename rather than *.tgz.
  5. Remove --force from routine instructions. If replacement is necessary, explain the affected state and require explicit user confirmation.
  6. Bundle the reviewed runtime source with the audited project or link to an immutable source revision corresponding exactly to the pinned artifact.
  7. Recommend reviewing hook behavior and granting the plugin access only to narrowly scoped, non-secret context files.
  8. Document a rollback procedure for disabling the plugin, removing its marketplace registration, and restoring previous configuration.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

/Applications/Codex.app/Contents/Resources/codex plugin marketplace add ~/.codex/openclaw-codex-claw-marketplace

text

Enable plugins and hooks in `~/.codex/config.toml`:

```toml
[features]

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

If verification fails, inspect diagnostics:

bash
tail -n 50 ~/.codex/codex-claw-hook.log
openclaw codex-claw status