omc-setup

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly reads and prints ~/.codex/settings.json (and shows the "Final settings.json" for review), which can contain env vars or tokens—causing any secrets in that file to be output verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Runtime path: Step 2A/2B uses curl to fetch outsider-authored free text from https://raw.githubusercontent.com/.../CODEX.md (public GitHub content) and writes it into ~/.codex/CODEX.md or ./.codex/CODEX.md, which Codex then ingests as readable prompt/context (including <remember> instructions).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The setup script explicitly downloads CODEX.md at runtime via curl from https://raw.githubusercontent.com/sigridjineth/oh-my-codex/main/docs/CODEX.md and injects it into the agent's CODEX.md (containing context/prompt instructions), so remote content fetched at runtime directly controls agent prompts and is a required dependency.