ClawHub
Back to skill

Security audit

CodexDelegate

Security checks across malware telemetry and agentic risk

Overview

This skill transparently delegates coding tasks to a local Codex CLI, with high-impact options disclosed and gated by user-directed sandbox choices.

Install only in trusted local workspaces where you are comfortable letting OpenClaw invoke your signed-in Codex CLI. Start with read-only, use workspace-write only for intended edits, use danger-full-access only in an isolated environment after explicit approval, and avoid sending secrets or production data unless that exact data flow is intentional.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The README encourages activation with broad natural-language phrases like "use Codex" or "delegate to Codex," which can easily appear in ordinary discussion about coding workflows. In an agentic system, overly generic triggers can cause unintended delegation to a powerful local CLI tool, leading to unexpected repository access, code changes, or command execution under the user's existing Codex authentication.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The wrapper explicitly permits running Codex with 'danger-full-access', which can give the delegated agent broad filesystem and command-execution capability with no additional confirmation or guardrail at invocation time. In this skill’s context, that is materially risky because the whole purpose is to pass user-supplied prompts and repository context to another agent, so prompt injection or user error could lead to destructive local actions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.