skills/nexu-io/open-design/hatch-pet/Gen Agent Trust Hub

hatch-pet

Pass

Audited by Gen Agent Trust Hub on May 4, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes subprocess.run across several scripts, including finalize_pet_run.py, generate_pet_images.py, and render_animation_videos.py, to automate asset processing. These calls are used to execute internal helper scripts and system utilities like ffmpeg for video rendering and curl for API requests. All commands are constructed using argument lists rather than shell strings, which effectively mitigates the risk of shell injection.
  • [EXTERNAL_DOWNLOADS]: The fallback generation script generate_pet_images.py makes network requests to the OpenAI API (api.openai.com) via curl. This is used to generate image assets when the primary system skill is unavailable. The interaction is consistent with the skill's purpose and targets a well-known, trusted service.
  • [SAFE]: No malicious patterns such as credential harvesting, unauthorized data exfiltration, or safety bypass instructions were identified. The skill's directory operations are localized to a dedicated application folder (~/.codex), and its logic is transparently documented and aligned with its intended functionality of asset creation.
Audit Metadata
Risk Level
SAFE
Analyzed
May 4, 2026, 05:15 PM