codex-app-mirror-installer

SUSPICIOUS. The skill is coherent in purpose, but its trust model is weak: it routes installer downloads through a personal GitHub mirror and custom domain rather than an official OpenAI channel. No credential theft or overtly malicious behavior is shown, yet using self-published checksums for mirrored executables makes this a medium supply-chain risk.