Suspicious.
The post promotes a paid service (SkyOS) across multiple coordinated accounts. While the post itself reads coherently, u/dexterthebot (26 items in 24h, 100% focused on r/codex) and u/Afraid_Willow_3407 (appearing as commenter with suspiciously supportive reply) form a coordination pattern. More critically, the domain reuse signal—github.com appearing across 5 separate prior-report accounts under different usernames—suggests a larger same-operator network systematizing cross-report promotion.
Hugin marked this suspicious because at least one meaningful risk signal appeared, but the scan did not reach the stronger likely-scam threshold.
- The final verdict text came from the AI verdict engine using the stored structural signal block.
- The scan reviewed 2 comments and 2 unique commenter accounts.
- Signal count: 0 high, 2 medium, 0 low flags; 5 coordination-class signals.
Single-purpose accounts (every comment in one sub) are how operators run sockpuppets without learning the rest of Reddit. Real accounts wander.
Full evidence trailSources, public checklist, values lens, network map, account coverage, archive, and sharing tools.
Review before sharing.
Hugin reports are evidence packets, not accusations. Use the rating as a prompt to inspect sources, limitations, and archived material before quoting a claim elsewhere.
A main memory for Codex: when a chat gets too long, start a new one and say "continue my last chat"
Source checks
2 public comments loaded for r/codex.
Public comment bodies were retained with the report snapshot.
1 author age value was unavailable after Reddit profile JSON, old Reddit profile HTML, and archive fallbacks.
3 selected author histories checked; 2 partial, 3 archive fallback.
2 reply edges mapped.
0 same-hand writing pairs surfaced.
4 unique external identifiers extracted.
5 prior archive matches returned.
Show your work
Deterministic explanation of the stored scan inputs behind the verdict. This is not hidden model reasoning; it is the evidence checklist Hugin can show publicly.
Hugin marked this suspicious because at least one meaningful risk signal appeared, but the scan did not reach the stronger likely-scam threshold.
- The final verdict text came from the AI verdict engine using the stored structural signal block.
- The scan reviewed 2 comments and 2 unique commenter accounts.
- Signal count: 0 high, 2 medium, 0 low flags; 5 coordination-class signals.
- The scan crossed the caution threshold, but did not show enough stacked proof for likely scam.
What pushed risk up
Single-purpose accounts (every comment in one sub) are how operators run sockpuppets without learning the rest of Reddit. Real accounts wander.
- u/dexterthebot — 26 items, all in r/codex
"github.com" was previously logged by Hugin under u/lumpy_vermicelli8869, u/ukanwat, u/timx88, u/freedomsaver, u/richhard. Same external identifier surfacing under multiple Reddit accounts across separate threads is a coordinated-operation pattern.
- u/lumpy_vermicelli8869 (report dcu-z6q-5td)
- u/ukanwat (report pau-xjq-fqm)
- u/timx88 (report gpq-9ys-uqw)
- u/freedomsaver (report 6rb-gf6-rc8)
- u/richhard (report abr-tx8-4s3)
5 identifier appearances matched older Hugin reports under different usernames.
- ext_domain "github.com" previously appeared under u/lumpy_vermicelli8869
- ext_domain "github.com" previously appeared under u/ukanwat
- ext_domain "github.com" previously appeared under u/timx88
- ext_domain "github.com" previously appeared under u/freedomsaver
- ext_domain "github.com" previously appeared under u/richhard
What limited confidence
1 scanned author had unknown account age. Profile metadata remained unavailable for 1 hosted fetch after archive fallbacks. Absence of young-account signals is lower confidence.
What kept the rating lower
Hugin mapped 2 reply edges and did not find a mutual-reply clique.
The writing-style comparison ran and did not surface same-hand pairs.
The fetched author histories did not show repeated URL drops, dormant-account reactivation, or throwaway drop-in behavior.
- 1 author account age was unavailable after profile metadata and archive fallbacks.
- 2 author age values are a lower-bound estimate from oldest archived public activity, not an official Reddit account-created timestamp.
- Username shape alone is never treated as a finding; it is only context when stronger public signals also appear.
- Likely scam: multiple high-severity signals, prior identifier reuse, or several coordination signals stacking together.
- Suspicious: one high-severity signal, multiple medium signals, or one concrete coordination signal that deserves review.
- Inconclusive: weak, conflicting, or partial signals where the scan cannot justify either trust or a stronger warning.
- Looks legitimate: no structural red flags, available metadata, and clean coordination passes.
Values lens
Use scans to slow down, inspect public signals, and keep uncertainty visible. Never use them to harass, shame, or flatten people into a verdict.
Fair-use checks
- What was observed, and what is interpretation?
- What data is missing, blocked, or confidence-limiting?
- Would the wording feel fair if it were about someone you care about?
What the post is doing
- u/dexterthebot shows extreme posting velocity (26 items in 24h) with exclusive focus on r/codex, matching bot/sockpuppet behavior profile
- Commenter u/Afraid_Willow_3407 appears in post and signals block; username shape and timing suggest potential coordination
- Cross-report domain reuse: github.com linked in prior reports by u/lumpy_vermicelli8869, u/ukanwat, u/timx88, u/freedomsaver, and u/richhard—5 accounts flagged as strong same-operator signal
- Post has 0 score and 0% upvote ratio yet continues promotion; combined with sock-puppet comments, suggests artificial engagement testing
- OP u/Jolly-Scientist-2484 posting in r/micro_saas, r/ClaudeAI, r/SaaS—typical pattern for monetized tool promotion across AI/startup subreddits
Automated flags
Single-purpose accounts (every comment in one sub) are how operators run sockpuppets without learning the rest of Reddit. Real accounts wander.
- u/dexterthebot — 26 items, all in r/codex
"github.com" was previously logged by Hugin under u/lumpy_vermicelli8869, u/ukanwat, u/timx88, u/freedomsaver, u/richhard. Same external identifier surfacing under multiple Reddit accounts across separate threads is a coordinated-operation pattern.
- u/lumpy_vermicelli8869 (report dcu-z6q-5td)
- u/ukanwat (report pau-xjq-fqm)
- u/timx88 (report gpq-9ys-uqw)
- u/freedomsaver (report 6rb-gf6-rc8)
- u/richhard (report abr-tx8-4s3)
Linked code repositories
GitHub repos linked in this thread were fetched and screened for malware-disguised-as-OSS patterns (postinstall scripts, fresh maintainer + thin commits, hardcoded wallets/tokens, drainer / sniper / checker naming, Telegram-routed READMEs).
This is a legitimate open-source game engine project with no malware-disguise patterns. The recent creation date and new maintainer account are normal for a newly-announced project; the technical scope, dependencies, and documentation are all consistent with genuine game development. No financial grift, credential theft, or code obfuscation indicators present.
- Newly created repo (34 days) and maintainer account (39 days) — typical for legitimate new projects
- Legitimate project scope: Total Annihilation engine reimplementation with documented purpose and clear technical vision
- MIT License properly declared and applied
- Clean go.mod with only standard, well-known game engine dependencies (Ebitengine, purego)
- No postinstall/preinstall scripts in go.mod
- README promises match actual project scope (game engine, not financial tools or 'free SaaS')
Shared signals
External identifiers (wallets, Telegram/Discord, referral links, promo codes, external URLs, emails) extracted from the post body and comments. Different accounts pointing at the same identifier — inside one thread or across separate reports — is the strongest coordination signal Hugin can show, sourced entirely from public post content.
Also appeared in prior reports under different accounts
Coordination map
Who replied to whom in the scanned comments. Organic threads branch out from the post; accounts that reply back and forth to each other or hub around one shared identifier are the structural fingerprints of a coordinated pod. This shows the most significant pattern found, not every commenter.
- Subject
- Procedural
Commenter patterns
Recent public Reddit activity for the OP and selected accounts, plus same-hand writing checks when the stylometry pass runs. These are coverage-limited evidence summaries, not identity or availability claims.
Reddit returned only part of this account's recent public activity during the scan.
- r/micro_saas (5)
- r/ClaudeAI (3)
- r/SaaS (3)
- r/mcp (3)
- r/codex (26)
Reddit returned only part of this account's recent public activity during the scan.
- r/ClaudeCode (14)
- r/codex (2)
- r/mcp (2)
- r/LLMDevs (2)
The writing-style pass ran and did not surface same-hand pairs.
Account age coverage
OP and scanned commenters are shown when Hugin recovered profile metadata or an oldest-public-activity age floor. Lower-bound ages are labeled as estimates; unknown age remains missing coverage, not a finding about the account.
Archived evidence
Snapshot of the post and comments at scan time. Preserved here so the evidence survives even if it gets deleted on Reddit.
- u/dexterthebotscore 0You might want to consider listing your project on the weekly Show-Us-What-You-Built post . Look out for it on Tuesday/Wednesday. Highest commented project wins a week promotion on r/Codex and gets on the Hall of Fame sidebar. See what that looks like below with last week's winner. Last week's most popular project was Nanolathe - an open-source engine bringing Total Annihilation to modern Mac, Windows, and Linux systems. It’s a solo passion project combining clean-room research with AI-assisted development, with a playable public alpha available now. Website: https://nanolathe.gg . GitHub: https://github.com/nanolathe-gg/nanolathe Players, testers, and contributors are very welcome! Original Total Annihilation game data is required to play.
- u/Afraid_Willow_3407score 0context drift is such a pain, keeping a separate state file for project decisions has been my go to fix.
Original on Reddit: https://www.reddit.com/r/codex/comments/1x4ubpw/a_main_memory_for_codex_when_a_chat_gets_too_long/ — “A main memory for Codex: when a chat gets too long, start a new one and say "continue my last chat"”
Share this report
Share this link in a Reddit reply when the thread needs supporting evidence. The report stays public so anyone reading the thread can review the data themselves.
Reports like this stay free for everyone. Keep Hugin free →