codex-orange-book-guide

SUSPICIOUS: the skill is mostly a documentation guide and not overt malware, but it combines inconsistent install instructions, transitive skill installation from URLs, credential forwarding to MCP helper processes, and high-autonomy agent workflows. The footprint is somewhat broader and riskier than a simple 'guide' and should be treated as medium-high security risk rather than benign.