codex-theme-maker

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.75). Both URLs point to personal GitHub repositories (unknown/third‑party author) that are used as sources for CLI tools/scripts — legitimate but potentially risky as they can distribute scripts or binaries outside official vendors and lack obvious trust signals.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly instructs cloning and running remote code at runtime from GitHub (e.g., "git clone https://github.com/Wangnov/awesome-codex-skins" and using https://github.com/Wangnov/gpt-image-2-skill and its scripts), which fetches external repositories whose code is executed as part of the workflow, so this is a runtime external dependency that executes remote code.