codex-app-ref-refresh

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill launches npx at runtime to fetch and execute remote npm packages (@electron/asar and prettier) — specifically the strings "@electron/asar" and "prettier" are invoked via npx and thus pull and run remote code (lines shown below).