codex2api-reverse-proxy

SUSPICIOUS: the skill is coherent for a reverse-proxy/admin gateway, and the install path is reasonably verifiable from the public repo and same-owner container image. However, its stated purpose is intrinsically high-trust: it collects and manages refresh/access tokens, API keys, prompts, and optional proxy routing, and it is published by a different entity than the upstream code source; the free-hosted demo and optional TLS-skip setting add caution. No clear hidden exfiltration or malicious installer behavior is shown, but the credential concentration and third-party routing role make this higher-risk than a normal documentation skill.