ClawHub
Back to skill

Security audit

Codex Auth

Security checks for vulnerabilities and agentic risk

Overview

This OAuth helper is mostly purpose-aligned, but it needs review because it handles long-lived login tokens using unsafe temporary files and can restart the local gateway in the background.

Install only if you are comfortable with this skill writing OpenAI OAuth access and refresh tokens into local OpenClaw auth files and potentially restarting the gateway. Avoid queue mode until token staging is moved out of /tmp, permissions are forced to 0600, queued payloads are deleted after use, state validation rejects missing state, and callback URLs are not passed through shell command arguments.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/codex_auth.py:109
Finding

OAuth secrets are stored in predictably named temporary files without enforced restrictive permissions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/codex_auth.py:186
Finding

Atomic replacement invalidates auth-profile locking and can weaken credential-file permissions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/codex_auth.py:324
Finding

OAuth state verification fails open when callback state is omitted

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/codex_auth.py:286
Finding

Sensitive OAuth callback credentials are accepted through command-line arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · RISK.md (reported line 16)May include surrounding context.

md
## Denied operations
- No remote shell execution (`curl|bash`, `wget|sh`).
- No `sudo`, SSH, package manager, or system mutation actions.
- No disclosure of full callback query params, access tokens, or refresh tokens.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill is presented as a deprecated shim that should redirect users elsewhere, but the content describes a fully active OAuth flow that exchanges tokens, writes auth data, and can restart the gateway. This mismatch is dangerous because users and automated governance may treat it as low-risk or inactive while it still performs privileged operations on sensitive credentials and local service state.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill can queue a background apply job that writes tokens to disk and controls the gateway lifecycle, which is far more powerful than its stated deprecated shim purpose suggests. In context, this mismatch is dangerous because users or callers may reasonably expect an auth helper, not a tool that creates persistence artifacts and asynchronously changes service state.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill declares no explicit tool scope or permission boundaries, yet the documented behavior includes shell execution, network access, and reads/writes of sensitive auth state. In an agent ecosystem, missing permission declarations weakens reviewability and enforcement, making it easier for a seemingly simple skill to perform higher-risk actions than operators expect.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/codex_auth.py (reported line 24)May include surrounding context.

python
TOKEN_URL = "https://auth.openai.com/oauth/token"
REDIRECT_URI = "http://localhost:1455/auth/callback"
SCOPE = "openid profile email offline_access"
JWT_CLAIM_PATH = "https://api.openai.com/auth"
OPENCLAW_CONFIG_PATH = str(Path.home() / ".openclaw" / "openclaw.json")
BACKUP_DIR = "/tmp/openclaw/safety-backups"
APPLY_STATUS_PATH = "/tmp/openclaw/codex-auth-apply-last.json"

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/codex_auth.py (reported line 238)May include surrounding context.

python
def run_cmd(cmd):
    return subprocess.run(cmd, capture_output=True, text=True)


def apply_with_gateway_restart(payload_path, auth_path):

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This deprecated compatibility/auth script performs active system reconfiguration, modifies persistent auth/config files, and stops/starts the gateway service. Those capabilities exceed a minimal auth-flow shim and increase the chance of unauthorized persistence, outages, or unsafe rollback behavior if the script is triggered unexpectedly or with manipulated inputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The apply path stops and restarts the gateway service as part of credential application without an immediate user confirmation in the action-performing code path. In a deprecated shim, undisclosed service interruption is risky because it can disrupt workloads and be abused as an availability-impacting action under the guise of authentication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The queued apply path writes OAuth access and refresh tokens into a payload file under /tmp/openclaw before launching a background job. Temporary directories are a poor place for sensitive secrets because they may be exposed to other local users/processes, persist longer than intended, and are not accompanied by clear user disclosure in this path.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
81% confidence
Finding

The code spawns a detached background process that later applies configuration and restarts the gateway, using attacker-influenced inputs such as --auth-path and a payload file in /tmp. Although it does not use a shell, background execution reduces visibility and control, and in this deprecated auth shim context it expands the blast radius beyond simple authentication.

Content

Scanner excerpt · scripts/codex_auth.py (reported line 366)May include surrounding context.

python
args.auth_path,
            ]
            with open("/tmp/openclaw/codex-auth-apply.log", "a", encoding="utf-8") as lf:
                subprocess.Popen(cmd, stdout=lf, stderr=lf, stdin=subprocess.DEVNULL)
            print(json.dumps({
                "ok": True,
                "profile": profile_id,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script persists access and refresh tokens to the auth profile file without an explicit disclosure or consent step in this code path. Persisting long-lived credentials is expected for OAuth tooling, but doing so silently in a deprecated shim increases surprise and reduces the user's ability to assess local secret-handling risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The comment says the non-queued path performs an immediate write with 'no restart,' but the same branch calls ensure_profile_declared_in_config and then reports restart_required and a config note telling the user to restart the gateway. That documentation understates the operational impact of the path and contradicts the emitted result semantics.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.