codex-mcp-skills

The project demonstrates a strong focus on security, with extensive threat modeling documentation, explicit input sanitization to prevent common vulnerabilities (e.g., path traversal, command injection in CLI binary names, GitHub query injection), and the use of environment variables for API keys. It actively audits dependencies using `cargo audit` (evidenced by `audit.toml`). The core server does not execute arbitrary skill code directly; instead, it provides skills to external, trusted AI clients (Claude/Codex), delegating execution risk. HTTP transport supports authentication and TLS. No 'eval' or obvious malicious patterns were found.