Codex All-in-One for ArkClaw

• Analyzed: May 16, 2026, 5:31 PM
• Findings: 1
• Version: 1.0.0
• Hash: b4e6b808d826f080b2f95ec569d35b8a0a0db5d2244fc62296f56879ca7d413e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle automates the installation and configuration of the Codex CLI, performing several high-risk operations including modifying `~/.bashrc` for persistence, installing global packages via `npm` and `pip`, and running background relay services. It handles sensitive API keys for multiple AI providers (AgentPlan, Kimi, DeepSeek) and stores them in local configuration files and environment variables. While these actions are consistent with the stated purpose of a 'one-click' setup utility, the modification of shell startup scripts and the handling of credentials represent a significant security surface. Legitimate endpoints used include ark.cn-beijing.volces.com and api.moonshot.cn.