codex-app-transfer-proxy

SUSPICIOUS. The skill’s capabilities mostly match its stated proxy purpose, including local config edits and forwarding requests to chosen model providers. The main concern is install trust: ara.so publishes the skill, but users are directed to install a desktop binary from an unrelated GitHub owner, creating a cross-publisher supply-chain dependency. Data flows are otherwise consistent with a local proxy, and the scanner’s command finding is a documentation false positive rather than active code execution.