codex-windows-fast-patch

SUSPICIOUS. The skill's invasive capabilities mostly match its stated goal of repairing and patching Codex Desktop on Windows, so this is not clear malware. However, its real footprint is unusually powerful for a skill: it executes many local scripts, modifies official app binaries/packages, handles auth-adjacent local state, downloads toolchain components, and relies on a third-party personal GitHub trust chain rather than an official OpenAI repair mechanism.

This code patches Codex Desktop assets to force multiple browser, computer-use, model, service-tier, and plugin gates open, and can package, sign, trust, install, and launch the modified app. Its notable security risks are adding NODE_REPL_TRUSTED_CODE_PATHS to trusted paths and adding a signing certificate to CurrentUser and, when elevated, LocalMachine Root/TrustedPeople stores. Fast Mode verification uses a dummy OPENAI_API_KEY and sends test traffic only to http://127[.]0[.]0[.]1 on a random port; no remote exfiltration or credential theft is shown. Severity is high for weakening trust and feature boundaries, although the code shown is not evidence of malware or a remote backdoor.

This PowerShell code installs or rolls back a hash-guarded patch to the @oai/sky Windows screenshot helper, redirecting its frame-arrival behavior and adding a worker wrapper; some profiles also modify PE metadata and clear the embedded certificate directory. It writes a verified backup and patched helper, and stops matching helper processes during replacement. No credential theft, network exfiltration, or unrelated destructive behavior is evident in the supplied fragment. Severity is moderate because modifying a signed executable affects integrity and trust, despite the narrow targeting and rollback support.

This fragment strongly suggests an out-of-band modification tool for Codex remote-control functionality. It does not show classic malware such as a reverse shell or third-party exfiltration domain, and it includes some token redaction and path protections. However, it deliberately rewrites application bundles, reads cached authentication tokens, injects them into requests, stores OAuth responses and private keys on disk, bypasses normal authentication/UI behavior, and enables software device-key fallback. The behavior is high risk for credential exposure and unauthorized application tampering; the entire package should be trusted only if this patcher is an authorized, reviewed component of the product.

The fragment is a legitimate-looking Windows build orchestration script with no direct evidence of malware or intentional sabotage. The main security concern is inherent execution of untrusted or mutable Git/Cargo source and unverified NuGet package contents. Use only trusted repository URLs, validated patches, pinned dependency sources, and preferably cryptographically verified SDK artifacts in an isolated build environment.

This wrapper itself contains no explicit network, credential-access, or persistence logic, but it performs high-impact dynamic execution by dropping an unseen Python payload ($script) into a randomized TEMP file and immediately running it. Any malicious behavior would most likely reside in the omitted Python payload and/or in how arguments expand filesystem scope. From the provided fragment alone, the strongest risk signal is the drop-and-execute design, which warrants inspection of $script and the executed Python entry logic.

This fragment is an OAuth PKCE desktop authorization helper that runs a localhost callback server, exchanges an authorization code for OpenAI tokens, stores access/refresh tokens and related identity info in ~/.codex/remote.json (chmod 0o600), and verifies the token against a “remote/control/clients” endpoint using the stored Bearer token. No obvious malware (no eval/exec, no reverse shell, no cryptomining, no suspicious exfiltration to unrelated domains) is present, but it is highly security-sensitive because it obtains and persists credentials for a remote-control capability and logs token metadata to disk. Overall, it looks like legitimate auth/token management code rather than an intentional sabotage payload.

This fragment tests a patch that removes service-tier authentication restrictions for `chatgpt`, `personalAccessToken`, and optionally `amazonBedrock`. That behavior could enable unauthorized access to gated functionality if the transformed asset is deployed, but this portion only reads and tests the transformation and does not show deployment or persistence. No domains, network exfiltration, or credential harvesting are shown. Severity is potentially significant if the patch is applied in production; evidence in this fragment alone is insufficient to establish malicious intent.