codex-image
Warn
Audited by Socket on May 16, 2026
1 alert found:
AnomalyAnomalySKILL.md
LOWAnomalyLOW
SKILL.md
SUSPICIOUS. The image-generation purpose is plausible and the data ultimately goes to OpenAI-owned domains, but the skill's core behavior hinges on automatically extracting and caching a ChatGPT browser session token for use with an unofficial internal endpoint. That credential-handling footprint is broader and less proportionate than a normal image API skill, especially with an unspecified browser automation dependency.
Confidence: 84%Severity: 69%
Audit Metadata