codex-windows-fast-patch-skill
Fail
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill extensively uses PowerShell with
ExecutionPolicy Bypassto run scripts that modify system configuration and application files. Most notably, it provides instructions for creating a self-signed certificate and importing it into theLocalMachine\Rootcertificate store. This is a high-privilege operation that alters the system's root trust anchors, potentially allowing any code signed with that certificate to bypass operating system security checks. - [EXTERNAL_DOWNLOADS]: The skill relies on
npx asarandnpm install, which download and execute packages from the NPM registry. It also includes an auto-update script (update-skill-from-github.ps1) that fetches new versions of the skill's own code from a remote GitHub repository. - [REMOTE_CODE_EXECUTION]: The auto-update mechanism allows for the automated retrieval and subsequent execution of code from a remote source. Furthermore, the skill's primary function is to unpack, modify (patch), and repack the application's internal JavaScript code (
app.asar), which constitutes a form of application tampering and local code injection.
Recommendations
- AI detected serious security threats
Audit Metadata