codedrobe-codex-theme

SUSPICIOUS. The stated purpose and local CDP-based theming behavior are mostly coherent, and the skill includes reasonable guardrails against app patching, external CSS, and silent image uploads. The main issue is install trust: it directs the agent to use a separate CodeDrobe desktop repository/package path that was not verifiable from the provided evidence, creating a disproportionate supply-chain dependency for a theming skill. No credential harvesting, proxy API routing, or clear exfiltration path is evident in the text.

Overall, this code does not show classic malware behaviors (no remote exfiltration, mining, or backdoor mechanics). The main security risk is powerful intended functionality: it constructs and executes a script in arbitrary matching browser targets via CDP session.evaluate. If CLI options or themeRef/theme files can be influenced by an attacker (especially the template renderer-inject.js usage), it could enable arbitrary code execution in the target page context and potentially sensitive DOM manipulation. Additional concerns include filesystem read/write path risks if path validation is weak, and limited CSS remote-resource validation. Review loadTheme() and renderer-inject.js to confirm data-only usage and robust path/option validation.

This PowerShell script primarily orchestrates local automation: it enables CDP on a configurable local port for the OpenAI Codex app and launches a companion Node module (injector.mjs) in watch/daemon mode, persisting state and logs under %LOCALAPPDATA%\CodeDrobe. There is no direct evidence of classic malware behaviors (no obvious hardcoded credentials, no eval/Function usage, no external exfiltration endpoints in this snippet). However, the pattern of enabling remote debugging plus running an injector module is security-sensitive and could be used for unauthorized control or data collection; the actual intent/maliciousness cannot be confirmed without the contents of injector.mjs and theme-tool.mjs.

This PowerShell fragment is a thin launcher that executes a local companion script (`injector.mjs`) via Node and forwards user-controlled parameters, particularly an optional `--screenshot` path, directly to the child process. The wrapper itself contains no explicit malicious code (no network calls, no file operations, no eval/encoding/deobfuscation), but it introduces security-relevant risk by (a) delegating execution to an external companion file without integrity verification and (b) forwarding an arbitrary screenshot path without validation. A definitive malware determination requires reviewing `injector.mjs` for behaviors such as screenshot capture/storage, filesystem access outside intended directories, network exfiltration, or persistence.