codex-app-ref-refresh

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The script invokes npx at runtime to fetch and execute packages ("npx -y @electron/asar" and "npx -y prettier"), which pulls code from the npm registry (e.g. https://registry.npmjs.org/) and thus executes remote code during the skill run.