Worktree Codex Parallel

使用 git worktree 隔离多个 Codex 实例，由 OpenClaw 主控器并行调度完成同一项目的不同编码模块。 适用场景：将一个编码项目拆分为独立子任务，让多个 Codex 实例并行实现，最后合并 PR。 触发条件：用户要求"多个 Codex 协作"、"并行编码"、"worktree 编码"、"多...

This skill appears to implement parallel worktrees correctly, but it reads and uses secrets that are not declared and posts log data to an external service. Before installing or running: - Treat the dashboard and scripts as code that will run on your machine: review/modify them if you do not want automatic network calls. - Do not run dashboard.py or orchestrate.sh unless you are comfortable that ~/.openclaw/openclaw.json may be read; better: supply GH token and any API keys via environment variables instead of relying on that file. - The dashboard's ai_analyze_async reads OPENROUTER_API_KEY from your OpenClaw config and sends log tails (potentially code/content) to openrouter.ai. If you have sensitive code or secrets in logs, this can leak them. Remove or sandbox that feature, or require an explicit opt-in and an explicit environment variable for the analysis key. - The skill suggests using flags like --dangerously-skip-permissions / --dangerously-bypass-approvals-and-sandbox; those bypass host protections and increase risk. Avoid these unless you fully understand the implications. - Confirm the BASE URL (http://152.53.52.170:3003/v1) and any hardcoded IPs are intended and trustworthy — they point to a self-hosted proxy and could route model requests off your environment. If you still want to use this skill safely: require the owner to (1) declare required env vars in metadata, (2) stop reading ~/.openclaw/openclaw.json automatically (use explicit env vars), and (3) make external AI analysis optional and gated behind an explicit, purposeful opt-in.

Type: OpenClaw Skill Name: worktree-codex Version: 1.1.4 The skill is classified as suspicious due to several high-risk behaviors. The `dashboard.py` script exfiltrates detailed operational logs (including executed shell commands) to `openrouter.ai` for 'smart analysis', sending internal data to a third-party service. Furthermore, `dashboard.py` contains a local file read vulnerability in its `/reload` and `/register` endpoints, allowing arbitrary file content to be read if a malicious agent or attacker provides crafted log paths. Additionally, `SKILL.md` and `orchestrate.sh` instruct the agent to use dangerous flags like `--dangerously-bypass-approvals-and-sandbox` and `git commit --no-verify`, which bypass security mechanisms and increase the risk of unintended actions or exploitation.