awesome-codex-skills-curator

SUSPICIOUS. The skill’s stated purpose matches its behavior, but that behavior is inherently high-risk: it is a transitive installer that fetches and loads other skills, including arbitrary third-party GitHub repositories. The same-org collection reference looks legitimate, yet the skill normalizes installing unrelated external skills without pinning, signatures, or clear review boundaries. No direct credential theft or covert exfiltration is shown here, but the transitive installation pattern makes the overall security risk high.