ClawHub
Back to skill

Security audit

OpenAI Codex Multi OAuth

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate Codex OAuth debugging purpose, but its default diagnostics can expose unredacted account, session, and usage details without clear opt-in.

Use this skill only when you are comfortable letting the agent inspect local OpenClaw OAuth profile and session files. Run diagnostics locally, prefer selecting specific profiles, review or redact output before sharing it, and treat JSON output from the usage script as potentially containing raw account metadata.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/codex_usage_report.py:167
Finding

Raw usage API response is disclosed in JSON output without explicit opt-in

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/summarize_codex_profiles.py:122
Finding

Default diagnostic report exposes unredacted profile and session-routing identifiers

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill instructs the agent to read local files and run local scripts, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates a capability/scope mismatch: a host may grant broader file or network access than an operator expects, increasing the risk of unintended data exposure or over-privileged execution during troubleshooting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The guidance explicitly recommends displaying user_id, account_id, and email during debugging, which are sensitive identifiers that can expose personal or account-linkage data in logs, screenshots, chat transcripts, or support channels. In this skill context, debugging multi-profile OAuth and usage mismatches increases the chance that these identifiers are surfaced across multiple accounts or workspaces, making accidental disclosure more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code loads auth profile data from local state files, extracts access tokens, and uses them in an HTTP request to the ChatGPT usage endpoint. While the script purpose is to fetch usage, there is no user-facing warning in comments or CLI help that it accesses sensitive credential material and transmits it over the network.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/codex_usage_report.py (reported line 31)May include surrounding context.

python
payload = access.split('.')[1]
        payload += '=' * (-len(payload) % 4)
        decoded = json.loads(base64.urlsafe_b64decode(payload.encode()).decode())
        return ((decoded.get('https://api.openai.com/profile') or {}).get('email'))
    except Exception:
        return None

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/summarize_codex_profiles.py (reported line 28)May include surrounding context.

python
payload = access.split('.')[1]
        payload += '=' * (-len(payload) % 4)
        decoded = json.loads(base64.urlsafe_b64decode(payload.encode()).decode())
        return ((decoded.get('https://api.openai.com/profile') or {}).get('email'))
    except Exception:
        return None

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script prints profile emails, session targets, and profile identifiers directly to stdout in both human-readable and JSON modes. Because this skill is specifically for inspecting OAuth profile state and debugging account/workspace selection, the output is likely to contain sensitive identity and routing metadata that can be exposed through terminal logs, screenshots, shell history capture, CI logs, or pasted diagnostics.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The script prints stored and API-returned email addresses, user IDs, and account IDs to stdout. The current help text does not warn users that personally identifying account data will be displayed, which can matter in shared terminals or logs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.