codex-cli

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The installer one-liners fetch-and-execute remote scripts from raw.githubusercontent.com (e.g. https://raw.githubusercontent.com/cskwork/claude-codex-skill/main/install.sh and https://raw.githubusercontent.com/cskwork/claude-codex-skill/main/install.ps1) which run remote code at install time and place SKILL.md (which directly controls the agent's instructions) into the Claude Code skills directory, so they are runtime external dependencies that can execute code and control prompts.