skills/gencraft-labs/skills/codex-pet/Gen Agent Trust Hub

codex-pet

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions provide shell scripts that perform directory management, file manipulation, and automated image processing using the RunComfy and ImageMagick command-line tools.
  • [EXTERNAL_DOWNLOADS]: The workflow requires downloading a reference image from an external HTTPS URL provided by the user to serve as the subject for the generated asset.
  • [INDIRECT_PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection by processing untrusted image data from external URLs through an AI image-editing model.
  • Ingestion points: The skill ingest images from a user-provided SOURCE_URL during the generation process.
  • Boundary markers: No delimiters or instructions are used to separate the image content from the model's instructions.
  • Capability inventory: The skill has the ability to execute shell commands, perform network operations via a CLI, and write files to the local file system.
  • Sanitization: The skill does not perform validation or content filtering on the input image before it is processed by the external API.
  • [PRIVILEGE_ESCALATION]: Prerequisite steps in the documentation suggest using system package managers like apt-get for installation, which typically require administrative privileges.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 12:39 PM