Codex Auth Cleaner

This skill is coherent in purpose — it contacts a Codex Provider Agent (CPA) management API and can disable or delete auth files — but there are important mismatches and risks you should consider before installing: - Missing metadata: The package metadata does not declare the required CPA_URL and CPA_KEY, yet the script needs them (via env vars or config.json). Expect to provide an admin key; ensure the registry omission isn't hiding additional secret requirements. - Destructive operations: The tool can permanently delete auth files on the CPA. Test with the status/check commands first and run against a staging instance. Back up or export current auth-file state before running delete/clean in production. - Principle of least privilege: Use a scoped admin key where possible. If the CPA supports a role that can only disable (not delete), prefer that for routine monitoring and only use a full-admin key when you intentionally run deletion. - Config file security: config.json will contain the admin key. Ensure the file is stored with restrictive permissions and verify where it will be saved (the skill directory under ~/.nanobot/workspace in examples). - Notifications unclear: The config includes Telegram/Discord settings but does not show where a bot token or webhook is supplied. Inspect the remainder of the script to confirm how notifications are sent and whether any additional secrets are required. - Review & auditing: Because the script performs network calls and deletions, review the full script (including the truncated portion) to confirm there are no unexpected external endpoints, no hidden logging/exfiltration, and that the delete logic matches your expectations (e.g., only deletes items confirmed by the double verification). If you want to proceed safely: (1) run the script in 'status' and 'check' modes against a test CPA instance, (2) inspect the complete source to confirm notification code and external endpoints, (3) restrict the CPA key used, and (4) ensure secure storage/rotation of the admin key. If you can provide the remainder of the script (truncated portion), I can re-evaluate and reduce uncertainty.