gomtm-codex-dev

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include a private/untrusted API endpoint (sub2api.yuepa8.com) repeatedly recommended for receiving API keys and routing requests, which is a high-risk practice because a third-party endpoint can exfiltrate keys, data, or deliver malicious payloads.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The repository intentionally instructs users to place their OPENAI_API_KEY into config/.env and to route all API traffic through an external private relay (sub2api.yuepa8.com), which enables unauthorized credential exposure and exfiltration of requests/data to a third-party.