Security audit

Codex Account Switcher

Security checks across malware telemetry and agentic risk

Overview

This skill matches its account-switching purpose, but it silently saves active Codex credentials into local snapshots on every run, so users should review it before installing.

Install only if you are comfortable with a local tool reading, writing, and duplicating Codex access and refresh tokens. Keep ~/.codex and ~/.openclaw auth files private, prefer sync --dry-run and --agent for OpenClaw updates, and be aware that running any command may save or refresh a local credential snapshot.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill clearly performs sensitive operations—reading and writing local authentication files, invoking shell commands, and managing tokens—but it does not declare explicit permissions beyond metadata requirements. This creates a permission-model gap: users or registries may not get a clear, enforceable warning that the skill can modify auth state and propagate credentials into other agent stores. In context, the functionality is intentionally sensitive rather than covert, but the missing formal permission declaration still increases the risk of accidental credential exposure or unauthorized token rewrites.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The script silently calls `sync_current_login_to_snapshot()` on every invocation, causing credential-bearing auth data to be created or updated even when the user only intended to list or compare accounts. In a skill that handles authentication tokens, undisclosed persistence materially increases the risk of credential sprawl, accidental retention, and surprise modification of sensitive local files.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Automatically writing credential snapshots on every run violates the principle of explicit user consent for sensitive operations. Because the skill manages access and refresh tokens, silent persistence increases the attack surface by leaving more copies of credentials on disk and making the skill's side effects less transparent to the operator.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This code copies access and refresh tokens into OpenClaw `auth-profiles.json` files for other agents, expanding the number of credential-bearing locations on disk. In the context of a tool already handling sensitive auth material, propagating live OAuth credentials across multiple agent stores without strong point-of-write disclosure materially raises the blast radius of local compromise or accidental exposure.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The agent `auth.json` synchronization routine writes OAuth access and refresh tokens into multiple agent-specific files, increasing credential duplication and persistence. Given the skill's sensitive context, this broadens exposure to any local process, backup system, or user that can read those files and makes credential handling less predictable.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.