hatch-pet

Pass

Audited by Gen Agent Trust Hub on Jun 18, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill employs subprocess.run in several scripts (finalize_pet_run.py, render_animation_videos.py) to chain internal Python logic and to call external tools like ffmpeg. These calls are restricted to project-specific scripts or standard utilities required for spritesheet assembly and video rendering.
  • [EXTERNAL_DOWNLOADS]: The generate_pet_images.py script serves as a secondary fallback, using curl to communicate with OpenAI's official Image API. This targets a well-known service and is a documented part of the skill's functionality for generating character assets when the primary system skill is unavailable.
  • [DATA_EXFILTRATION]: The skill sends prompt text and image data to OpenAI's API via encrypted HTTPS requests. This is consistent with the skill's primary purpose of image generation and does not involve unauthorized data access or exfiltration to unknown domains.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 18, 2026, 06:45 AM