Security audit
Security checks across malware telemetry and agentic risk
This legacy OAuth refresher is not clearly malicious, but it needs review because it copies Claude tokens, modifies credential stores and auth files, installs a persistent macOS job, and auto-detects messaging targets.
Install only if you specifically need this legacy refresher and understand that it will handle live Claude OAuth tokens. Prefer Clawdbot's native Claude OAuth setup if available. Before running install.sh, review the launchd service, disable or manually configure notifications, protect auth-profiles.json, and be aware that the skill copies refresh credentials out of Keychain and keeps a background refresher running.
**Connect your Claude subscription to Clawdbot in one step.** Automatically: - ✅ Reads Claude OAuth tokens from Keychain - ✅ Writes them to Clawdbot in proper OAuth format - ✅ Auto-refreshes every 2 hours (before expiry) - ✅ Notifies you on success/failure
### Refresh Process 1. **Read from Keychain:** Gets OAuth tokens from `Claude Code-credentials` 2. **Check Expiry:** Only refreshes if < 30 minutes left (or `--force`) 3. **Call OAuth API:** Gets new access + refresh tokens 4. **Update auth-profiles.json:** Writes proper OAuth format
2. **Check Expiry:** Only refreshes if < 30 minutes left (or `--force`) 3. **Call OAuth API:** Gets new access + refresh tokens 4. **Update auth-profiles.json:** Writes proper OAuth format 5. **Update Keychain:** Syncs new tokens back 6. **Restart Gateway:** Picks up new tokens 7. **Notify:** Sends success/failure message (optional)
**Simplified, Claude-only:** - No multi-provider complexity - Reads from `~/.config/claude/auth-profiles.json` - Retrieves refresh token from Keychain (`claude-cli-auth` service) - Calculates expiry with buffer (default: 30 min) - Makes OAuth request to `auth.anthropic.com` - Updates `auth-profiles.json` atomically
- Calculates expiry with buffer (default: 30 min) - Makes OAuth request to `auth.anthropic.com` - Updates `auth-profiles.json` atomically - Updates Keychain if refresh token rotates - Sends notifications via Clawdbot - Comprehensive error handling with actionable messages
# Apply defaults if not set
KEYCHAIN_SERVICE="${KEYCHAIN_SERVICE:-$DEFAULT_KEYCHAIN_SERVICE}"
KEYCHAIN_FIELD="${KEYCHAIN_FIELD:-$DEFAULT_KEYCHAIN_FIELD}"
AUTH_FILE="${AUTH_FILE:-$DEFAULT_AUTH_FILE}"
PROFILE_NAME="${PROFILE_NAME:-$DEFAULT_PROFILE_NAME}"
CLIENT_ID="${CLIENT_ID:-$DEFAULT_CLIENT_ID}"# Apply defaults if not set
KEYCHAIN_SERVICE="${KEYCHAIN_SERVICE:-$DEFAULT_KEYCHAIN_SERVICE}"
KEYCHAIN_FIELD="${KEYCHAIN_FIELD:-$DEFAULT_KEYCHAIN_FIELD}"
AUTH_FILE="${AUTH_FILE:-$DEFAULT_AUTH_FILE}"
PROFILE_NAME="${PROFILE_NAME:-$DEFAULT_PROFILE_NAME}"
CLIENT_ID="${CLIENT_ID:-$DEFAULT_CLIENT_ID}"# Apply defaults if not set
KEYCHAIN_SERVICE="${KEYCHAIN_SERVICE:-$DEFAULT_KEYCHAIN_SERVICE}"
KEYCHAIN_FIELD="${KEYCHAIN_FIELD:-$DEFAULT_KEYCHAIN_FIELD}"
AUTH_FILE="${AUTH_FILE:-$DEFAULT_AUTH_FILE}"
PROFILE_NAME="${PROFILE_NAME:-$DEFAULT_PROFILE_NAME}"
CLIENT_ID="${CLIENT_ID:-$DEFAULT_CLIENT_ID}"}
# Get ALL account names for this service
log "Scanning for all '$KEYCHAIN_SERVICE' entries..."
ALL_ACCOUNTS=$(security dump-keychain 2>/dev/null | \
awk '/^class: "genp"/,/^keychain:/ {
if (/"acct"<blob>=/) {66/66 vendors flagged this skill as clean.
No suspicious patterns detected.