codex-theme-installer
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads theme asset packages from the vendor's official domain at codexthemes.ai. It implements validation checks on the downloaded content, including a 30 MB size limit and verification of the JSON schema and theme metadata.
- [COMMAND_EXECUTION]: Local TypeScript scripts are utilized to automate the installation and configuration processes, executed through
npx tsxto manage dependencies and runtime environment. - [CREDENTIALS_UNSAFE]: The skill manages a
CODEXTHEMES_API_KEYfor higher rate limits on the vendor's API. It follows secure credential management practices by storing the key in a local JSON file with restrictive permissions (0600), providing a secure stdin-based input method to avoid shell history, and masking the key in all CLI outputs.
Audit Metadata