Security audit
worktree-codex
Security checks for vulnerabilities and agentic risk
Overview
The skill largely does what it claims (orchestrates multiple agents using git worktrees) but it reads private OpenClaw config files, suggests bypassing sandbox protections, and defaults to an unknown proxy IP and external model endpoints — behaviors that are disproportionate or unexplained for the stated purpose.
This skill implements the advertised worktree + multi-agent workflow, but it performs several surprising actions that increase risk: - It reads ~/.openclaw/openclaw.json to obtain tokens (GitHub/OpenRouter) rather than requiring you to provide a token explicitly. Before installing, inspect that file to see what credentials it contains and avoid giving the skill access to it if you don't trust it. - The skill defaults model traffic to an unfamiliar IP address (http://152.53.52.170:3003). Do not point your real API key at unknown proxies — set OPENAI_BASE_URL explicitly to a provider you trust or run without that default. - SKILL.md suggests bypassing sandbox and permission checks for WSL. Avoid using flags that disable sandboxing unless you fully understand and accept the consequences; prefer fixing permissions or running in an isolated environment instead. - The dashboard sends log tails to openrouter.ai for analysis using a key from your config. Logs can contain secrets; either disable the remote analysis, remove secrets from logs, or run the dashboard offline. - If you decide to use it: run the skill in an isolated/test repository, supply explicit tokens (pass GH_TOKEN to push_and_pr.sh rather than relying on reading global config), audit and possibly remove the ai_analyze_async call, and review every auto-commit/auto-push before merging. If you are not comfortable with these risks, do not install or run this skill with real credentials or on production repositories.
SkillSpector findings are pending for this release.