soia-env-codex-install

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The URL https://chatgpt.com/codex/install.sh is a direct shell installer script (remote .sh) from a domain that's not the canonical platform.openai.com/chat.openai.com host and thus represents a higher-risk download/execute vector; the other listed links are documentation or official vendor pages and are low risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly directs using the official independent installer at runtime (macOS/Linux prefer the official installer) which is given as a curl | sh command that would fetch and execute remote code from https://chatgpt.com/codex/install.sh, so this external URL is a runtime dependency that can execute remote code.