clawdex
Fail
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill explicitly promotes the use of
codex --yolo, which is described as having "no sandbox" for the "fastest" execution of generated code on the host machine. This bypasses standard safety constraints for LLM-generated content.\n- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install@openai/codexvia npm. This is not a recognized official package from OpenAI, suggesting a significant risk of supply chain attack or typosquatting.\n- [CREDENTIALS_UNSAFE]: The architecture is designed to manage and access highly sensitive files, specifically/work/clawd/wallet/box-wallet.json(Solana private keys) and~/.claude/browser.env(BROWSER_USE_API_KEY). This configuration creates a high-value target for exfiltration.\n- [REMOTE_CODE_EXECUTION]: The skill facilitates the automated execution of code generated by remote models (including a fictionalgpt-5.3-codex) directly in both local and remote (Upstash) environments without mandatory human review.\n- [PROMPT_INJECTION]: The skill exhibits a high vulnerability to indirect prompt injection. \n - Ingestion points: Untrusted data enters the context via
browser-harness-js navigate(web content) and file-based audits (e.g., "Audit the pump SDK"). \n - Boundary markers: No delimiters or safety warnings are present to isolate untrusted external content. \n
- Capability inventory: The agent possesses full shell access (
bash pty:true), un-sandboxed code execution (codex --yolo), and crypto wallet signing capabilities. \n - Sanitization: There is no evidence of sanitization or validation of data retrieved from external URLs before processing it through the dual-engine reasoning loop.
Recommendations
- AI detected serious security threats
Audit Metadata