codexplusplus-launcher

SUSPICIOUS. The skill’s capabilities broadly match its stated purpose, but the install path relies on a community GitHub project with unclear publisher relationship and direct local execution. This is primarily a supply-chain/provenance risk rather than confirmed malware or credential theft.