gomtm-codex-dev

SUSPICIOUS: 技能用途与本地 Codex 配置维护总体一致，未见隐藏执行、预执行注入或明显恶意载荷；但它显式引导把 OpenAI-compatible API key 发往私有中转域名 sub2api.yuepa8.com，而非官方 OpenAI API，这在数据流上构成中间代理/凭据转交风险。总体更像高风险第三方配置指南，而不是确认恶意技能。

No malicious execution behavior is evident because the fragment is purely declarative configuration. However, it includes a hardcoded API credential field ("OPENAI_API_KEY": "sk-"), which is a significant supply-chain secret-handling risk. The key should be removed from the artifact and replaced with a secure secret-injection mechanism (environment variables, secret manager) and the key should be rotated if it ever corresponded to a real credential.