Security checks across malware telemetry and agentic risk
This skill is a disclosed Codex automation tool, but it can persistently run hooks and send Codex outputs to Telegram, with risky default routing values.
Install only if you intentionally want OpenClaw to run Codex for you and send Codex completion content to Telegram. Before enabling it, replace all sample chat IDs and bot account names, review the notify hook path in ~/.codex/config.toml, avoid using it on confidential repositories unless notifications are minimized or disabled, and be cautious with the 100-year session-retention and cron options.
def log(msg: str) -> None:
"""写入日志（用于调试）"""
try:
with open(LOG_FILE, "a", encoding="utf-8") as f:
f.write(f"[{datetime.now().strftime('%H:%M:%S')}] {msg}\n")
except Exception:
passstate["updatedAt"] = now_iso()
# 写回文件
with open(PROJECT_STATE_FILE, "w", encoding="utf-8") as f:
json.dump(state, f, ensure_ascii=False, indent=2)
log(f"project state updated: task={PROJECT_TASK_ID}, status=review_pending")66/66 vendors flagged this skill as clean.