skills/aicae/opendesign/hatch-pet/Gen Agent Trust Hub

hatch-pet

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to orchestrate multiple internal Python scripts for spritesheet composition, frame extraction, and atlas validation. It also invokes system utilities like ffmpeg to render preview videos of the pet animations.- [EXTERNAL_DOWNLOADS]: The skill provides a fallback mechanism in scripts/generate_pet_images.py that utilizes curl to interact with the OpenAI API for image generation. This communication is directed to a well-known service endpoint at api.openai.com.- [PROMPT_INJECTION]: The skill ingests user-supplied text prompts and reference images to define pet characteristics. It implements safeguards against indirect prompt injection through detailed instructional boundaries and post-generation validation checks.
  • Ingestion points: User prompts and reference files processed by scripts/prepare_pet_run.py.
  • Boundary markers: The SKILL.md contains explicit rules for the agent regarding transparency, character consistency, and stylistic constraints to prevent unwanted generations.
  • Capability inventory: The skill possesses the ability to execute internal shell commands and perform network requests to well-known OpenAI endpoints.
  • Sanitization: Output verification is performed by scripts/inspect_frames.py and scripts/validate_atlas.py to ensure generated assets adhere to required dimensions, transparency, and silhouette rules.- [SAFE]: All identified behaviors, including the use of environmental API keys and file system writes to ~/.codex/pets, are necessary for the skill's intended operation and do not exhibit malicious patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 08:29 PM