codex-router-external-models
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the user to download and execute shell scripts directly from a remote source. Specifically, it uses
curl -fsSL https://raw.githubusercontent.com/duolahypercho/codex-router/main/install.sh | shfor macOS/Linux and a similarInvoke-WebRequestpattern for Windows PowerShell that bypasses execution policies to runinstall.ps1. This allows the remote server to execute arbitrary code on the host machine. - [EXTERNAL_DOWNLOADS]: In addition to the installers, the skill encourages cloning an external repository (
https://github.com/duolahypercho/codex-router.git) and installing global Node.js packages (@moonshot-ai/kimi-code,@xai-official/grok) which may contain unverified code dependencies. - [COMMAND_EXECUTION]: The skill relies on executing various local binaries (
./bin/model-router,./bin/refresh-catalog, etc.) that are bundled with the external repository. These scripts perform high-privilege operations such as modifying the user's~/.codex/config.tomlfile and setting up background system services. - [CREDENTIALS_UNSAFE]: The core functionality involves capturing, storing, and managing sensitive API keys and OAuth tokens for numerous providers (Anthropic, DeepSeek, xAI, Kimi, etc.). While the skill claims to use "invisible prompts" and "credential isolation," the underlying execution of untrusted remote code creates a significant risk of these secrets being exfiltrated to an attacker-controlled server.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/duolahypercho/codex-router/main/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata