Safety

Is it safe? The 30-second answer

  • ✓ Never modifies the official .app, app.asar, or code signature — official updates install normally
  • ✓ Never reads or rewrites your API key, Base URL, or model provider settings
  • ✓ The debug port binds to 127.0.0.1 only — never exposed to your network
  • ✓ Fully reversible: one command restores the stock look without modifying the official app; Windows shortcut removal is optional
  • ⚠ One honest caveat: the loopback CDP port is unauthenticated while the skin runs — avoid untrusted local software, restore when done

Pre-install checklist

☑ Download from the official repo only

Get the engine from github.com/Fei-Away/Codex-Dream-Skin — not re-uploaded ZIPs from forums or netdisks.

☑ Skim the scripts before running

They are short shell / PowerShell files written to be audited. If a script is obfuscated, walk away.

☑ Confirm the platform requirements

On macOS, launch Codex once before installing. On Windows, use the Microsoft Store OpenAI.Codex package with PowerShell 5.1+ and Node.js 22+.

☑ Treat antivirus warnings carefully

Current daily shortcuts use RemoteSigned, but some antivirus products still flag PowerShell or LNK launcher behavior. Do not whitelist it blindly: verify the official source, update to the latest main branch, inspect the scripts, and rerun the installer.

☑ Shared machine? Restore after each session

The debug port lives only while the skin is active. On machines that run untrusted software, treat theming as a session, not a state.

One-click restore, anytime

The official app was never modified. Restore returns its appearance and closes the managed debug session; on Windows, add -Uninstall separately if you also want to remove shortcuts:

macOS 
~/.codex/codex-dream-skin-studio/scripts/restore-dream-skin-macos.sh --restore-base-theme --restart-codex
Windows 
powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\scripts\restore-dream-skin.ps1 -RestoreBaseTheme -PromptRestart

Known compatibility issues (and the fix)

The engine's CSS targets specific Codex versions. On newer builds or the English UI you may see: overlapping banner text, invisible suggestion cards, or areas rendering as solid color blocks. This is a rendering mismatch, not a security problem — and Codex can repair it itself. Paste this prompt into Codex:

My Mac has a Codex Dream Skin theme installed (engine at ~/.codex/codex-dream-skin-studio). Injection works, but my Codex version has rendering glitches:

[describe what you see, e.g. overlapping banner text / suggestion cards invisible / an area rendering as a solid color block]

Read assets/dream-skin.css and scripts/injector.mjs inside the engine directory, inspect the real home-screen DOM through the engine's local CDP port, and fix the affected CSS selectors and layout rules. Only modify files inside the engine directory — never touch the official .app, app.asar, or code signature — and keep one-click Restore working. After fixing, run scripts/verify-dream-skin-macos.sh --reload --screenshot and show me the screenshot.

Privacy and account data

CodexSkins never reads data from your Codex installation. Anonymous submissions store the metadata, preview, and optional package you deliberately upload for moderation. If you sign in with Google, we store your Google account id, verified email, display name, avatar URL, and a hashed session token so you can download packages and access account-linked submission history. We use Google Analytics and Microsoft Clarity for traffic measurement. Contact qcrao91@gmail.com to request account or submission removal.

Go deeper