Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

codex-cn-bridge

Enable OpenAI Codex CLI to use domestic Chinese AI models via protocol conversion and auto-configuration with support for multiple providers.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 176 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The SKILL.md describes a Codex→Chinese-model protocol bridge (Qwen, Kimi, GLM) which is coherent with the skill name and description. However the registry metadata lists no required environment variables or install steps while the README clearly expects API keys and an installer; that mismatch suggests the metadata is incomplete or out of sync with actual behavior.
Instruction Scope
Runtime instructions are explicit and scoped to the bridge: create ~/.codex/, place a .env with provider API keys, run /codex-cn-bridge install/start/stop/test/exec and edit ~/.codex/cn-bridge/models.yaml. The instructions limit file access to the ~/.codex tree and Codex configuration (config.toml) and logs. There is no instruction to read unrelated system files, but the agent will be asked to modify Codex config and create files under the user's home directory.
Install Mechanism
The skill has no install spec in registry metadata (instruction-only). The SKILL.md recommends installing via the OpenClaw skills manager or cloning a GitHub repo (https://github.com/luckKiven/codex-cn-bridge.git). Downloading from GitHub is a standard approach, but because the registry did not embed an install package, following the instructions will download and execute external code at install/run time — inspect the repository before running any install/start commands.
!
Credentials
The registry lists no required environment variables, yet the SKILL.md explicitly instructs users to provide multiple provider API keys (QWEN_API_KEY, KIMI_API_KEY, ZHIPU_API_KEY) via ~/.codex/cn-bridge.env or environment variables. That mismatch is a red flag: the skill will request sensitive credentials not declared in metadata. Only provide the specific keys you intend the bridge to use and avoid sharing .env files.
!
Persistence & Privilege
The skill promises 'one‑click auto‑configure Codex' and lists a config.toml that will be 'automatically created'. That implies the installer or scripts will modify Codex CLI configuration (agent-level config) and write files under ~/.codex. The skill is not marked always:true, but automatic modification of another tool's configuration is a notable privilege that you should audit before allowing it.
What to consider before installing
This skill appears to do what it says (bridge Codex to Chinese providers), but there are discrepancies and privileges you should review before installing: 1) The registry metadata does not declare the API keys the documentation asks you to supply — expect to provide QWEN_API_KEY, KIMI_API_KEY, ZHIPU_API_KEY (and similar). 2) The SKILL.md instructs you to clone/run code from the project's GitHub repo and to run an install/start command that will create/modify files under ~/.codex and modify Codex's config.toml — inspect those scripts first. 3) Before running any install/start commands, manually review the repository (proxy.py, start scripts, install scripts, and any network calls) for unexpected behavior or secret exfiltration. 4) Keep the .env file local (do not commit it), and prefer creating a provider-specific key with minimal scope. 5) If you are unsure, run the installation in an isolated/test environment or container and verify what config changes are made. If you can provide the actual repository contents or an install script, I can re-evaluate with higher confidence.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk97a5hammwbg3m8af060340qmd82b0aq

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Codex CN Bridge Skill

让 OpenAI Codex CLI 使用国内 AI 模型(阿里云 Qwen、Kimi、智谱 GLM 等,目前默认支持百炼 coding plan)


🎯 功能

  • 协议转换 - OpenAI Responses API → 国内模型 Chat API
  • 多模型支持 - Qwen3.5-Plus、Qwen-Coder-Plus、Qwen3-Max、Kimi-K2.5、GLM-5
  • 一键启动 - 自动配置 Codex,无需手动设置
  • 双配置模式 - 支持 .env 文件 或 环境变量

📦 安装

方式 1:ClawHub 安装(推荐)

# 1. 安装 skill
openclaw skills install codex-cn-bridge

# 2. 运行安装脚本(自动下载完整代码)
/codex-cn-bridge install

方式 2:GitHub 下载

# 克隆完整代码
git clone https://github.com/luckKiven/codex-cn-bridge.git

# 复制到 skills 目录
cp -r codex-cn-bridge ~/.openclaw/workspace/skills/

⚙️ 配置(二选一)

⚠️ 安全提醒

.env 文件包含敏感 API Key,请勿上传到 GitHub 或公开分享!

Skill 已提供 .env.example 模板,复制后修改:

cp ~/.codex/cn-bridge.env.example ~/.codex/cn-bridge.env
# 然后编辑 .env 文件填入真实 API Key

方式 1:.env 文件(推荐)

编辑 ~/.codex/cn-bridge.env

# 阿里云通义千问(推荐)
QWEN_API_KEY=sk-your-alibaba-cloud-key

# 月之暗面 Kimi(可选)
KIMI_API_KEY=sk-your-moonshot-key

# 智谱 GLM(可选)
ZHIPU_API_KEY=sk-your-zhipu-key

方式 2:环境变量

# PowerShell
$env:QWEN_API_KEY="sk-your-key"

# CMD
set QWEN_API_KEY=sk-your-key

# 永久设置(推荐)
[System.Environment]::SetEnvironmentVariable("QWEN_API_KEY", "sk-your-key", "User")

🚀 使用

启动服务

/codex-cn-bridge start

测试连接

/codex-cn-bridge test

执行 Codex 命令

/codex-cn-bridge exec "帮我写个快速排序"

进入交互模式

/codex-cn-bridge interactive

查看状态

/codex-cn-bridge status

停止服务

/codex-cn-bridge stop

📊 可用模型

模型名称提供商适用场景
qwen3.5-plus阿里云通用任务(推荐)
qwen-coder-plus阿里云编程专用
qwen3-max阿里云复杂任务(最强)
kimi-k2.5月之暗面长文本处理
glm-5智谱通用任务

🔧 切换模型

# 使用编程专用模型
codex exec -c model="qwen-coder-plus" -c model_provider="cn-bridge" "写个函数"

# 使用最强模型
codex exec -c model="qwen3-max" -c model_provider="cn-bridge" "复杂任务"

⚠️ 注意事项

  1. 服务需保持运行 - 使用 Codex 前确保代理服务已启动
  2. API Key 必备 - 至少配置一个模型的 API Key
  3. 端口占用 - 默认使用 3000 端口,如被占用请修改配置

📁 文件结构

~/.codex/
├── cn-bridge.env          # API Key 配置
├── config.toml            # Codex 配置(自动创建)
└── cn-bridge/             # 代理服务目录
    ├── proxy.py           # 协议转换服务
    ├── models.yaml        # 模型配置
    └── start.bat          # 启动脚本

🆘 常见问题

Q: 启动失败,端口被占用

A: 运行 /codex-cn-bridge stop 停止旧进程,或修改配置中的端口

Q: Codex 切换模型卡住

A:

  1. 检查服务状态:/codex-cn-bridge status
  2. 检查 API Key 是否正确
  3. 查看日志:~/.codex/cn-bridge/logs/

Q: 添加新模型

A: 编辑 ~/.codex/cn-bridge/models.yaml,添加新模型配置


💡 技术原理

Codex CLI (Responses API)
        ↓
   [协议转换层]
   OpenAI Responses → Chat Completions
        ↓
   国内模型 API
   (阿里云 / Kimi / 智谱)
        ↓
   [响应转换层]
   Chat Completions → Responses
        ↓
Codex CLI 收到响应

版本: 1.0.0
作者: jixiang
许可: MIT
GitHub: https://github.com/luckKiven/codex-cn-bridge

Files

1 total
Select a file
Select a file to preview.

Comments

Loading comments…