codex-dream-skin-theme-injector
Fail
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches a project repository from an external GitHub account (
github.com/Fei-Away/Codex-Dream-Skin.git) which includes the scripts used for installation and theme injection. - [COMMAND_EXECUTION]: Executes shell scripts (
.sh,.command) and PowerShell scripts (.ps1) that perform system-level changes, including creating directories in application support folders and modifying execution policies. - [REMOTE_CODE_EXECUTION]: Utilizes the Chrome DevTools Protocol (CDP)
Runtime.evaluatemethod to inject and execute arbitrary JavaScript code into the running Codex desktop application. This mechanism bypasses standard application boundaries to modify runtime behavior. - [PERSISTENCE_MECHANISMS]: Automatically configures the host system to run the injection scripts at every login by creating a macOS LaunchAgent (
com.codex.dreamskin.plist) and a Windows Scheduled Task. - [PRIVILEGE_ESCALATION]: The Windows installation routine attempts to register a scheduled task with the
-RunLevel Highestparameter, requiring administrative privileges to ensure the script runs with elevated permissions.
Recommendations
- AI detected serious security threats
Audit Metadata