Security

Overview

GptSkin changes how your Codex workspace looks, not how it works. This page explains exactly how the Skill applies themes, what it can and cannot touch, and the risks we believe you should know about. The Skill is open source on GitHub, so every claim here is auditable.

Loopback-Only CDP Injection

Themes are applied through the Chrome DevTools Protocol (CDP), enabled via a launch flag that binds the debugging port only to the loopback address (127.0.0.1). The injector pushes CSS variables, backgrounds, and controlled decorative layers into the running Codex app.

• The port is never exposed to your network — nothing off your machine can reach it.
• The Skill disconnects after applying the theme, but the loopback debugging port remains available for the lifetime of the Codex process launched with that flag.

What We Never Modify

GptSkin does not touch:

• The official app installation package or app.asar
• Code signatures
• Your API Key or Base URL
• Your Codex configuration files

Because nothing in the official installation is patched, an app update cannot be corrupted by GptSkin. Interface changes may require a Skill update or re-application.

No Access to Your Conversations

The injector does not read or modify your Codex conversation content. It does not transmit your Codex DOM, session data, or chat content to the cloud. The paid build service receives the image chosen for the theme and basic theme metadata — not the natural-language request used with Codex imagegen, and never your Codex session.

An Honest Disclosure: Loopback Port Risk

We want to be transparent about one inherent limitation: a loopback CDP port has no application-layer authentication. While the themed Codex process is running, another process under the same local user account could attempt to connect to that port. This requires code already running locally as you, but it is a real property of CDP. The Skill binds the port to 127.0.0.1, selects a Codex target, applies the theme, and disconnects promptly.

Theme Package Integrity

Theme packages delivered from our servers are verified with a hash check before application, so a corrupted or tampered package is rejected instead of being injected.

Device Authorization and Credential Storage

The normal login uses a 10-minute device authorization code. The server stores only SHA-256 digests of the device and user codes, requires an explicit same-origin approval from a verified account, and exchanges each code at most once. The returned token is scoped only to theme and Credit APIs; it cannot access chats, code, or payment actions.

The scoped token is stored in ~/.gptskin/config.json; the Skill creates the directory and file with restrictive permissions (0700 and 0600) on supported systems and owner-only ACLs on Windows. Manual API keys remain an advanced compatibility feature.

Restore Mechanism

Every change GptSkin makes is reversible. Restore the default Codex theme removes all injected CSS, backgrounds, and decorative layers and restarts Codex normally — no leftovers, no repair installs.

Open Source and Auditable

The full Skill source is published at github.com/WendongAI/gptskin-skill. We encourage you to read the injector code, verify its Credit, image upload, build, and artifact requests, and confirm that it never reads your conversations. Found an issue? Report it to support@gptskin.best.

Verification and Change History

Last verified: July 28, 2026.

• Verified loopback-only CDP, scoped token storage, no conversation or DOM upload, artifact hash checks, and the restore path against GptSkin Skill v0.6.0 and production behavior.
• Recheck this disclosure after a Skill release or a change to authentication, storage, artifact delivery, or Codex desktop integration.
• Review the public Skill releases, or contact GptSkin to report a security documentation issue.