ClawHub
Back to skill

Security audit

Codex Adapter Toolkit

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a coherent configuration-management skill for AI coding tools, with expected but sensitive handling of API keys and backup/restore settings.

Install only if you want this skill to help manage AI tool provider configuration and related secrets. Keep API keys out of source control and logs, restrict permissions on any settings files, and make a fresh backup before using restore operations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explicitly supports API key management, notification configuration, and credential-bearing values such as SMTP connection strings, but it does not warn about secure storage, redaction, file permissions, or avoiding plaintext exposure in scripts and logs. In a tool that centralizes multiple provider credentials and may run monitoring/backup workflows, this omission can lead to accidental credential disclosure or insecure handling by users and downstream automation.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The documented backup and restore flow includes a direct restore operation without warning that existing configuration may be overwritten, including active provider settings and stored credentials. In this skill's context, restores could roll back to stale or incorrect endpoints, reintroduce old secrets, or disrupt service availability, especially because the tool manages failover and startup behavior.

Static analysis

No suspicious patterns detected.