codex-windows-fast-patch-skill

SUSPICIOUS: the skill’s actions broadly match its stated purpose, but that purpose is to patch and bypass Codex Desktop feature gates by modifying vendor binaries and reinstalling a locally signed MSIX. The main security issue is install/execution trust: mutable GitHub auto-updates, unpinned npm tooling, and unclear publisher-to-repo provenance make the workflow higher risk than a normal documentation skill. No clear credential theft or exfiltration is shown, so this is not confirmed malware.