codex-sdk

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains runtime npx commands that fetch and execute remote npm packages (e.g., "npx -y codex mcp-server" and "npx -y @modelcontextprotocol/server-filesystem" — see npm package pages such as https://www.npmjs.com/package/codex and https://www.npmjs.com/package/@modelcontextprotocol/server-filesystem), which will download and run remote code that provides MCP tooling that directly controls agent prompts and behavior.