exec

SUSPICIOUS. The skill’s core behavior is broadly aligned with its stated purpose as a plan executor, but its footprint is high-risk: unrestricted Bash, repeated bypassPermissions subagents, autonomous code/review/finalize loops, and optional execution of an unverified external_review_cmd. The default Codex path appears legitimately documented by OpenAI and is not itself a malicious indicator, but the overall skill still grants disproportionate autonomy and exposes prompt-injection and command-execution risk.