Summary

When trying to install a community plugin (openclaw-codex-app-server) that legitimately uses child_process (to spawn the Codex CLI), installation is blocked with no way to proceed:

```
WARNING: Plugin "openclaw-codex-app-server" contains dangerous code patterns: Shell command execution detected (child_process) (src/client.ts:660)
Plugin "openclaw-codex-app-server" installation blocked: dangerous code patterns detected
```

Steps to reproduce

```bash
openclaw plugins install openclaw-codex-app-server

or

openclaw plugins install openclaw-codex-app-server --dangerously-force-unsafe-install
```

Both commands result in the same blocked error.

Expected behavior

--dangerously-force-unsafe-install should bypass the block (as its name implies), or there should be a --trust flag (which the error message and community docs suggest exists, but does not).

Workaround

Manually add the plugin ID to plugins.allow in openclaw.json after the plugin is already present in ~/.openclaw/extensions/:

```bash
openclaw config set plugins.allow '["openclaw-codex-app-server", ...]'
openclaw gateway restart
```

This is not documented and is hard to discover.

Context

• OpenClaw version: 2026.3.31 (213a704)
• macOS (darwin)
• Plugin: openclaw-codex-app-server@0.5.0 (community, source-linked on ClawHub)