codex-cli-model-bridge

SUSPICIOUS. The skill’s core behavior is coherent with its stated purpose of managing a local Codex model bridge, and it avoids obvious malware patterns like remote payload execution or known exfiltration endpoints. However, it is still medium-high risk because it forwards existing Codex/ChatGPT credentials through external proxy infrastructure (CLIProxyAPI), modifies sensitive local config, and can install/run local background proxy components; these behaviors are powerful and trust-expanding even when locally scoped.

No explicit indicators of covert malware (no external C2, no suspicious payloads, no eval/obfuscation) are present in this code fragment. However, it contains a significant supply-chain/runtime integrity risk: it executes a local helper via execFileSync where the helper executable/interpreter and arguments can be influenced by environment variables, and the helper output becomes an Authorization Bearer token injected into all proxied requests (including upgraded connections). Additionally, the proxy forwards largely unvalidated request.url and headers to a privileged upstream on localhost, so any local caller reaching the proxy can gain access through the injected token. Overall: functionality appears intended, but trust boundaries are critical and the security risk is substantial if environment variables or the helper file are not strictly controlled.