Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only skill for using Codex CLI with Openclaw, with expected but important guidance around credentials and automation settings.
Install only if you intend Openclaw to invoke Codex CLI for coding tasks. Prefer dedicated workspaces, avoid broad `--add-dir` use, use `Allow once` or explicit approvals when unsure, and be careful with API keys and `--full-auto` because those settings can spend account quota and modify files in the allowed workspace.
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
codex --version codex login codex login --device-auth codex exec ""
Mention `codex "<prompt>"` only when the user explicitly wants a human-driven interactive session.
The skill instructs users to pipe the value of OPENAI_API_KEY directly into a login command. While this is a common shell pattern, it normalizes handling a secret on the command line boundary and may expose the credential through shell history substitutes, wrapper tooling, logging, or accidental output capture in automated environments. In a skill specifically about non-interactive automation, this increases the chance the pattern is copied into CI or agent logs.
```bash
printenv OPENAI_API_KEY | codex login --with-api-key
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Examples:
codex exec --cd /path/to/workspace "<prompt>"
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
```bash
codex exec --cd /path/to/app --add-dir /path/to/shared "<prompt>"
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Example:
codex exec --skip-git-repo-check "<prompt>"
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Example:
codex exec --skip-git-repo-check "<prompt>"
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Examples:
codex exec -a on-request -s workspace-write "<prompt>"
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
```bash
codex exec --full-auto "<prompt>"
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Examples:
codex exec --json "<prompt>"
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
```bash
codex exec -i screenshot.png "Match this UI design."
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
```bash
codex exec -m gpt-5.4 "<prompt>"
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Use short examples like these:
codex exec "Add a README section for local development."
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
```bash
codex exec "Implement a login retry feature with exponential backoff in the Openclaw client."
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
```bash
codex exec "Write a Python script that reads a CSV file and outputs a JSON summary by category."
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
```bash
codex exec "Modify the file upload endpoint to reject files larger than 10 MB and add a test for it."
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
```bash
codex exec --json "List all API endpoints in this workspace."
If the user explicitly wants an interactive chat, use: