Security model

Decoration should never hide a new permission boundary.

A skin changes appearance. It should not carry executable code, model settings, API credentials, or silent installer behavior inside a decorative download.

Local artwork processing

Selected images are decoded, previewed, cropped, encoded, hashed, and packaged in the browser.

Data-only recipe

Exports contain images, JSON, text, and checksums. They do not contain scripts or executables.

Separate installation trust

The website does not run the platform engine. Users review and run that software locally.

Visible recovery path

A theme workflow is incomplete until its verification and restore entries have been tested.

What can still go wrong

Untrusted local software can reach CDP

Loopback limits network exposure, but Chromium CDP does not provide same-user authentication. Avoid untrusted local programs while a themed debugging session is active.

Application updates can break selectors

Codex UI changes can make injected CSS inaccurate or hide important states. Verify after every significant app or engine update.

Artwork can create legal risk

A technically safe package can still violate copyright, personality, trademark, or contract rights when shared or sold.

A screenshot can hide broken controls

A visual match is not enough. Native buttons, menus, project controls, task content, and the composer must remain interactive.

What a Codex Skin Maker recipe contains

manifest.json — package identity, file list, and safety flags
theme.json — crop, opacity, blur, variant, and color values
background.webp — locally cropped background image
preview.png — locally rendered review image
checksums.json — SHA-256 values for the main files
README.txt — install boundary and restore reminders
LICENSE.txt — artwork and trademark rights reminder

Report a security or privacy issue

Email [email protected] with the affected page, browser, operating system, reproduction steps, and expected result. Do not attach API keys, authentication files, confidential artwork, or private Codex screenshots.