fix ruff

Author: rcholic

src/predicate_secure/adapters.py

@@ -360,7 +360,7 @@ def create_openclaw_adapter(
         AdapterError: If OpenClaw adapter initialization fails
     """
     try:
-        from .openclaw_adapter import OpenClawAdapter, OpenClawConfig, create_openclaw_adapter as create_adapter_impl
+        from .openclaw_adapter import create_openclaw_adapter as create_adapter_impl
     except ImportError as e:
         raise AdapterError(
             f"OpenClaw adapter requires openclaw_adapter module. Error: {e}",

src/predicate_secure/openclaw_adapter.py

@@ -9,18 +9,14 @@
 
 from __future__ import annotations
 
-import asyncio
 import json
 import os
 import subprocess
 import threading
 from dataclasses import dataclass
 from http.server import BaseHTTPRequestHandler, HTTPServer
-from pathlib import Path
 from typing import Any, Callable
-from urllib.parse import parse_qs, urlparse
-
-from .detection import Framework
+from urllib.parse import urlparse
 
 
 @dataclass
@@ -241,7 +237,10 @@ def start_cli(self, task: str | None = None) -> subprocess.Popen:
         env["PREDICATE_PROXY_URL"] = f"http://localhost:{self.config.skill_proxy_port}"
 
         # Start process
-        process = subprocess.Popen(
+        # Security: cmd is built from trusted config (cli_path) and user-provided task
+        # The cli_path comes from OpenClawConfig which is controlled by the developer
+        # Task parameter is validated and passed as a separate argument (not shell-interpolated)
+        process = subprocess.Popen(  # nosec B603
             cmd,
             cwd=working_dir,
             env=env,