show-dont-tell

The provided fragment is an installation guide, not malicious code by itself. It directs execution of an unreviewed remote package and a shell installer that persistently modifies `~/.codex/AGENTS.md`; this presents a meaningful supply-chain and agent prompt-injection risk. The actual installer and skill contents are required for definitive malware assessment.