omx

The skill’s purpose, package source, and stated credential use are broadly consistent. The main security concern is its recommended launch mode, which bypasses Codex approvals and sandboxing while enabling autonomous, parallel code execution. Avoid that mode unless the environment and tasks are trusted; the unpinned global npm installation is a lesser supply-chain concern.