Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed helper for delegating local coding tasks to Codex through MCP, with meaningful power to change a repository but no evidence of hidden, deceptive, or unrelated behavior.
Install this only if you want an OpenClaw agent to delegate real repository work to your local Codex setup. Review prompts before using full-auto, set --cwd to the intended project, avoid --yolo or danger-full-access unless explicitly needed, and inspect diffs/tests after each run.
The skill invokes shell commands and enables local code/tool execution but does not declare any explicit tool scope such as allowed-tools or permissions. That makes the capability boundary implicit, which increases the chance that an agent or reviewer underestimates what the skill can do and allows broader execution than intended.
The description is broadly worded to activate on many common software-development requests, which can cause this powerful skill to be selected by default even when a simpler or safer approach would suffice. In context, that increases exposure to autonomous shell use and code modification across routine tasks.
The skill explicitly recommends ask --full-auto for implementation, refactoring, and test-writing, which authorizes autonomous repository modification. Although the document later suggests validation, it does not provide a prominent warning that this mode can change files and execute actions in the target repo, creating a meaningful risk of unintended or unsafe changes.
The helper allows timeout=None, which permits child processes to run indefinitely. In this skill's context, the script brokers requests to local development tools that may perform expensive or hanging operations, so an unbounded call can tie up the agent, consume resources, or stall automation pipelines.
def run(cmd: list[str], *, timeout_ms: int | None = None) -> subprocess.CompletedProcess[str]:
timeout = None if timeout_ms is None else max(1, timeout_ms / 1000)
return subprocess.run(cmd, text=True, capture_output=True, timeout=timeout)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run(cmd: list[str], *, timeout_ms: int | None = None) -> subprocess.CompletedProcess[str]:
timeout = None if timeout_ms is None else max(1, timeout_ms / 1000)
return subprocess.run(cmd, text=True, capture_output=True, timeout=timeout)
def require_binary(name: str) -> str:
No suspicious patterns detected.