Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- bin/cli.js:40
- Evidence
const result = spawnSync(process.execPath, args, { stdio: "inherit" });
Security audit
@psyb0t/codexbox
Security checks for vulnerabilities and agentic risk
Overview
This plugin is a disclosed bridge to a user-run codexbox MCP server and its powerful file and prompt tools, with no hidden install behavior found.
Install this only when you intend to connect OpenClaw to a codexbox server you control or trust. Configure CODEXBOX_URL carefully, use the bearer token option for exposed servers, and remember that the connected agent may be able to read, write, and delete files in the codexbox workspace.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.dangerous_exec