soia-env-codex-setup-support

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Most links are official (openai, npm, github, help.openai.com, nodejs.org), but https://chatgpt.com/codex/install.sh is a direct shell-install script on a non-obvious domain and piping a remote .sh is a high-risk distribution vector that could deliver malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's references include a runtime installation command that pipes a remote script to the shell (curl -fsSL https://chatgpt.com/codex/install.sh | sh), which the skill may execute when performing CLI updates with user confirmation.