hatch-pet
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill employs
subprocess.runin several scripts (finalize_pet_run.py,render_animation_videos.py) to chain internal Python logic and to call external tools likeffmpeg. These calls are restricted to project-specific scripts or standard utilities required for spritesheet assembly and video rendering. - [EXTERNAL_DOWNLOADS]: The
generate_pet_images.pyscript serves as a secondary fallback, usingcurlto communicate with OpenAI's official Image API. This targets a well-known service and is a documented part of the skill's functionality for generating character assets when the primary system skill is unavailable. - [DATA_EXFILTRATION]: The skill sends prompt text and image data to OpenAI's API via encrypted HTTPS requests. This is consistent with the skill's primary purpose of image generation and does not involve unauthorized data access or exfiltration to unknown domains.
Audit Metadata