codex-auth-helper-chrome-extension
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs users to clone and install code from an unverified GitHub repository:
https://github.com/zhishile/codex-auth-helper.git. This repository is not affiliated with a known trusted organization or the skill author's verified infrastructure. - [DATA_EXFILTRATION]: The primary purpose of the skill is to facilitate the extraction of highly sensitive session credentials, specifically the
__Secure-next-auth.session-tokencookie fromchatgpt.com. While the skill claims local processing, providing tools to export these tokens to a file (auth.json) creates a high risk of accidental exposure or targeted theft if the underlying extension code is malicious. - [COMMAND_EXECUTION]: The installation instructions include shell commands (
git clone,cd) to fetch and navigate to external code, which is a common vector for introducing malicious software into a user's environment.
Recommendations
- AI detected serious security threats
Audit Metadata