Security audit

Codex / OpenClaw 卸载重装（Windows）

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a Windows reinstall/troubleshooting guide, but it asks users to make persistent Codex credential/configuration changes and irreversible reset actions without enough safety boundaries.

Install only if you specifically want a deep OpenClaw/Codex reinstall and provider repair workflow. Before following it, back up Codex data, treat API keys as secrets, use a limited or disposable provider key where possible, review any edits to ~/.codex files, and require confirmation before unregistering WSL distros, deleting/moving profile data, changing global AGENTS.md behavior, or setting up a persistent local proxy.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (12)

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 91% confidence
Finding: The skill instructs direct inspection and modification of ~/.codex/config.toml in the agent configuration directory. Access to agent config can be legitimate for repair, but it is high risk because it can alter trust boundaries, provider settings, authentication behavior, and persistent agent behavior across sessions.
Content: Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.
md
用户常问"OpenAI 网站登录不了，Codex 还能用吗"。答案：**能，且不需要登录 OpenAI**。 Codex 支持自定义 model provider，第三方 API（DeepSeek 等）与 ChatGPT 登录是两条平行路径。 ⚠️ 关键：重装后程序会**自动重写 `~/.codex/config.toml`**（写入 plugins / mcp_servers / marketplaces 等桌面版配置），把用户原有的自定义 provider 配置冲掉。所以必须**手工回填**。 ### 回填方法（注意 TOML 语法陷阱）

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: This step again targets ~/.codex/config.toml and nearby auth material during a sensitive reconfiguration flow. In context, the danger is amplified because the same section also introduces custom provider and credential handling, so mistakes or abuse here could redirect traffic, weaken authentication storage, or persist unsafe settings.
Content: Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.
{ "OPENAI_API_KEY": "sk-..." }

text
改前先备份：`cp ~/.codex/config.toml <工作区>/备份/config.toml.重装后原始备份` ### 上线前先验证 API 侧（curl 直连，比改配置快）

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 92% confidence
Finding: The skill instructs reading and restoring files under ~/.codex, including auth.json and config.toml, which exposes and manipulates persistent agent credentials and configuration. This is particularly sensitive because auth.json contains API credentials and the instructions normalize manual credential restoration into the agent config area.
Content: Scanner excerpt · SKILL.md (reported line 364)May include surrounding context.

确认 ~/.codex/auth.json 缺失，同时确认 config.toml 顶层键未丢：
bash
ls -la ~/.codex/auth.json # 期望 NOT EXIST grep -E "^(model_provider|model |cli_auth_credentials_store)" ~/.codex/config.toml

写回 ~/.codex/auth.json（只两行；内容从备份取，或用户级 OPENAI_API_KEY 环境变量）：
json

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Backing up and rewriting ~/.codex/config.toml during startup troubleshooting can persistently change agent behavior and create additional copies of sensitive configuration in less protected locations. In this skill, those copies may include provider paths and auth-storage settings that broaden exposure if mishandled.
Content: Scanner excerpt · SKILL.md (reported line 382)May include surrounding context.
text
4. 备份 `config.toml` 后重启桌面版（先备份，防止启动时重写把自定义 provider 冲掉）： ```bash cp ~/.codex/config.toml "<备份目录>/config.toml.已修复-$(date +%F)"

启动桌面版 —— 必须用 node 直调，不能用 cmd //c codex.cmd app （Git Bash 下 //c 转义会失效，只弹一个空 cmd 就退出，进程根本没起来）：

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: These instructions perform irreversible uninstall, deletion, unregister, and process-kill actions on user software and state, but the skill does not present a prominent upfront warning about data loss, credential loss, or the need for explicit user confirmation before destructive steps. In a support skill, destructive remediation can be legitimate, but omitting a clear safety gate increases the risk of accidental data loss and unintended disruption.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill tells users to place API keys into ~/.codex/auth.json and user environment variables, but does not give a clear warning that these secrets may be stored in plaintext, recoverable by other local processes, or left behind in backups and logs. This creates avoidable credential exposure risk, especially because the skill also recommends multiple backup and file-manipulation steps around the same directories.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: The skill tells users to send authenticated requests with a bearer token to an external third-party endpoint for connectivity testing. Even though this is operationally relevant, it causes secret-bearing network transmission outside the local environment and should be treated as sensitive external data flow.
Content: Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.
改前先备份：cp ~/.codex/config.toml <工作区>/备份/config.toml.重装后原始备份

上线前先验证 API 侧（curl 直连，比改配置快）

bash
curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: Bearer $KEY" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: This finding is a concrete external endpoint for the same authenticated test flow, reinforcing that the skill directs outbound communication to api.deepseek.com. The risk is contextually expected for configuring a third-party provider, but it still involves deliberate secret transmission and remote dependency trust.
Content: Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.
bash
curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: Bearer $KEY" \ https://api.deepseek.com/v1/models # Responses 接口是否支持（决定 wire_api 取值） curl -s -X POST https://api.deepseek.com/v1/responses \ -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The POST example sends both a bearer token and request content to a third-party responses API. This increases exposure beyond a simple reachability check because it transmits prompt content and may create provider-side logs or retention records.
Content: Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.
md
curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: Bearer $KEY" \ https://api.deepseek.com/v1/models # Responses 接口是否支持（决定 wire_api 取值） curl -s -X POST https://api.deepseek.com/v1/responses \ -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" \ -d '{"model":"deepseek-v4-flash","input":"say OK"}' # 注意：curl -o 在本沙箱写 Temp 目录会静默失败，直接打到 stdout 更可靠

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Embedding a hardcoded instruction such as 'always use Simplified Chinese' changes the agent's global behavior without requiring user opt-in and can override user preference or enterprise policy. This is not a classic security exploit, but it is an unsafe behavioral override because it persists as an instruction rather than being a transient user-selected setting.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill directs writing a global AGENTS.md instruction that forces all future responses into Simplified Chinese for every project. Because this is global and persistent, it can silently alter unrelated workflows and user expectations beyond the original reinstall task.
Content: No source excerpt is available for this finding.

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Content: Scanner excerpt · SKILL.md (reported line 363)May include surrounding context.

确认 ~/.codex/auth.json 缺失，同时确认 config.toml 顶层键未丢：
bash
ls -la ~/.codex/auth.json # 期望 NOT EXIST grep -E "^(model_provider|model |cli_auth_credentials_store)" ~/.codex/config.toml

写回 ~/.codex/auth.json（只两行；内容从备份取，或用户级 OPENAI_API_KEY 环境变量）：

Overview

A.I.G

SkillSpector

Agent Config Directory Access

Agent Config Directory Access

Agent Config Directory Access

Agent Config Directory Access

Missing User Warnings

Missing User Warnings

External Transmission

上线前先验证 API 侧（curl 直连，比改配置快）

External Transmission

External Transmission

Natural-Language Policy Violations

Natural-Language Policy Violations

File System Enumeration