01
Verified Windows target
The runner validates the registered Microsoft Store package, manifest executable, signature kind, process path, debugger owner, and launch-time Browser ID.
Safety model
A narrow, visible boundary.
CodexSkin changes the renderer you see without modifying the application you trust. Safety comes from strict inputs, exact local identities, visible restart consent, and a tested recovery path—not from pretending CDP is harmless.
No app patch
No credential migration
127.0.0.1 only
Verified restore
02
Existing profile preserved
The themed launch keeps your current Codex profile. It does not copy, migrate, or rewrite credential data.
03
Consent before restart
CodexSkin tells you to save unfinished input and never closes an open Codex window without explicit approval.
04
Strict theme data
Unknown JSON fields, arbitrary CSS, absolute paths, extra scripts, unsafe URLs, and oversized image content are rejected.
05
No application patch
WindowsApps, app.asar, installers, application bundles, and official code signatures are never modified.
06
Identity-safe restore
Restore checks the saved package, process, port, Browser ID, Node, and injector identities before stopping anything.
Remaining CDP risk
Local does not mean authenticated.
Binding Chromium DevTools Protocol to 127.0.0.1 prevents LAN access, but CDP has no same-user authentication. Other software running as your user could attempt to inspect the themed renderer. Run only trusted local software and restore when finished.
Unsigned preview
Verify the runner separately.
“Store package verified” refers to the official Codex application, not CodexSkin. The current ZIP and launcher scripts are not code-signed. Compare the downloaded ZIP against the published SHA-256 before running it.
Ready to continue?