add-codex
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various local shell commands for building the project (
pnpm run build,./container/build.sh), running tests (bun test,vitest), and managing the agent service (launchctl,systemctl). These are standard development operations within the NanoClaw ecosystem. - [EXTERNAL_DOWNLOADS]: The skill fetches code from a internal branch named
providersand installs the@openai/codexpackage. The package is a well-known resource from a trusted vendor, and the branch-based file fetching is a local operation for this specific agent platform. - [REMOTE_CODE_EXECUTION]: The skill uses
pnpm exec tsxto run setup scripts. These scripts facilitate authentication and configuration within the platform's own architecture and do not involve executing untrusted remote code. - [CREDENTIALS_UNSAFE]: The skill explicitly mentions that credentials are 'vault-only' and handled by OneCLI, which is a security best practice for managing API keys and tokens rather than storing them in environment files.
Audit Metadata