Codex Profile Failover

• Analyzed: Apr 19, 2026, 8:21 AM
• Findings: 1
• Version: 1.0.2
• Hash: c9848be71957dbace042cbc4f232dda31d0ffce5f80b4cbae4f95770db33c4f8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to automate OpenAI Codex profile rotation by monitoring usage limits and updating session configurations. While the logic appears consistent with its stated purpose, it performs high-risk operations including reading raw authentication tokens from 'auth-profiles.json', making network requests to 'chatgpt.com' using those tokens (in codex_profile_runtime.py), and programmatically modifying 'sessions.json' to override authentication profiles. The inclusion of a background watchdog script and the handling of sensitive credentials without clear encryption or sandboxing qualify it as suspicious, despite the lack of evidence of intentional malice or data exfiltration.