code-explorer

SUSPICIOUS. The stated purpose is narrow and plausible, but the skill depends on an unverified external `codex-subagent` executable and routes task context into that black-box tool. No direct credential theft or malicious payload is shown, yet the unverifiable CLI requirement makes the skill high risk under the mandatory dependency rules.