codex-auth-helper-chrome-extension

SUSPICIOUS. The static findings themselves are mostly benign documentation artifacts, but the skill's real footprint is sensitive: it installs an unpacked Chrome extension from an unrelated personal GitHub repo and uses it to extract and save ChatGPT session tokens. There is no evidence of outbound exfiltration beyond local download, but the publisher/source mismatch and credential-export design make the trust model weak and the overall risk high.