codex-chatgpt-web-integration

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs are direct downloads of installer scripts (.sh and .ps1) from a third‑party GitHub releases page (unknown account) which is high risk because piping remote scripts to sh/iex can execute arbitrary code.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The README documents intentional features that expose local filesystem/shell and forwarded environment secrets to a remote ChatGPT process via an OpenAI tunnel, includes an "auto-approve" bypass for tool calls, and instructs executing remote install scripts — collectively creating high-risk vectors for remote code execution, credential exfiltration, and supply-chain abuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md, the bridge explicitly sends Codex user-supplied task context as messages to the local Responses API and then uses Playwright to interact with ChatGPT Web, so any free text a user types/inputs into Codex flows into the runtime LLM via the Responses request.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The README includes install commands that fetch and immediately execute remote scripts (curl ... | sh and irm ... | iex) from https://github.com/miuuyy/codex-chatgpt-web/releases/latest/download/install-launcher.sh and https://github.com/miuuyy/codex-chatgpt-web/releases/latest/download/install-launcher.ps1, and a git clone of https://github.com/miuuyy/codex-chatgpt-web.git which downloads code that is then run—these are runtime external dependencies that execute remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). This skill explicitly enables ChatGPT to use Codex's filesystem and shell via MCP (full-harness mode) and documents an "auto-approve" option that bypasses write approvals, which can allow the model to modify local files and otherwise change machine state.