The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run() in scripts/finalize_pet_run.py to execute several local utility scripts for image processing, manifest updates, and packaging. It also uses subprocess.run() in scripts/render_animation_videos.py to invoke the ffmpeg system utility for rendering animation previews.
[EXTERNAL_DOWNLOADS]: scripts/generate_pet_images.py makes network requests using urllib.request to api.openai.com (a trusted vendor) to generate images when the primary $imagegen skill is unavailable. This script requires an OPENAI_API_KEY which it correctly reads from environment variables.
[INDIRECT_PROMPT_INJECTION]: The skill takes user input in the form of pet descriptions and style notes and interpolates them into instructions for visual generation. While this is an attack surface, it is consistent with the skill's primary purpose.
Ingestion points: args.pet_notes and args.style_notes are captured in scripts/prepare_pet_run.py and written to prompts in the prompts/ directory.
Boundary markers: The skill does not use specific delimiters or 'ignore embedded instructions' warnings around user input, though the surrounding prompt structure defines the role of the input.
Capability inventory: The skill has the capability to perform network requests (to OpenAI), write to the local file system (specifically ~/.codex), and execute shell commands (ffmpeg).
Sanitization: The skill performs minimal string formatting but does not escape or validate user text for prompt-injection patterns.

hatch-pet