codex-hygiene-skill

SUSPICIOUS: the stated purpose is coherent with local Codex telemetry/config inspection, but the install path is a weakly verifiable third-party GitHub clone with a publisher mismatch and no pinning or release verification. No explicit credential harvesting or exfiltration is shown, so this is not confirmed malware; the main concern is supply-chain trust in the installed skill script.