codex-chatgpt-web-integration
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs users to download and execute shell and PowerShell scripts directly from the internet using
curl ... | shandirm ... | iexpatterns. This bypasses all security checks and allows the remote server to execute arbitrary code on the host machine. (Evidence: SKILL.md curl -fsSL https://github.com/miuuyy/codex-chatgpt-web/releases/latest/download/install-launcher.sh | shandirm https://github.com/miuuyy/codex-chatgpt-web/releases/latest/download/install-launcher.ps1 | iex)- [EXTERNAL_DOWNLOADS]: The skill relies on external binaries and scripts hosted on a personal GitHub repository (
miuuyy/codex-chatgpt-web) that are not from a trusted organization or well-known vendor. These resources are executed with high privileges during installation. - [COMMAND_EXECUTION]: The documentation encourages running local servers and browser automation tools (Playwright) which open local network ports (7878, 7879) and handle sensitive browser session data, increasing the local attack surface.
Recommendations
- HIGH: Downloads and executes remote code from: https://github.com/miuuyy/codex-chatgpt-web/releases/latest/download/install-launcher.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata