codex-provider-sync-skill
Fail
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs users to download a binary executable (CodexProviderSync.exe) from a release page on a personal GitHub repository (github.com/Dailin521/codex-provider-sync), which is an unverified source.
- [REMOTE_CODE_EXECUTION]: The installation instructions include 'npm install -g git+https://github.com/Dailin521/codex-provider-sync.git', which fetches and installs code directly from a remote repository. This method bypasses the standard verification processes of official package registries.
- [COMMAND_EXECUTION]: The tool's primary function is to execute commands that modify sensitive local system files, including the configuration file (
/.codex/config.toml) and the SQLite state database (/.codex/state_5.sqlite). If the third-party tool is malicious, these operations could be used to compromise the application state or exfiltrate session data.
Recommendations
- AI detected serious security threats
Audit Metadata