opencodex-setup

SUSPICIOUS: The skill is broadly coherent with its stated purpose, but it installs and configures a third-party local proxy that receives and forwards raw provider API keys and traffic. The npm-based install path and traceable repo reduce concern, yet personal-package provenance and credential forwarding keep the overall risk above benign.