The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses git fetch origin providers to retrieve data from a remote repository and then employs git show to overwrite local source files (e.g., src/providers/codex.ts, container/agent-runner/src/providers/codex-app-server.ts) with content from the remote branch.
[REMOTE_CODE_EXECUTION]: The container/Dockerfile is modified to globally install the package @openai/codex via pnpm. This package is not a known official OpenAI utility, and its naming convention suggests a potential impersonation or typosquatting attempt, leading to the execution of untrusted code within the container environment.
[COMMAND_EXECUTION]: The installation process requires the user to execute pnpm run build and ./container/build.sh. These commands compile and build container images using the code fetched from the remote branch and the suspicious NPM package, effectively executing the downloaded logic on the host and inside the container.

add-codex