hatch-pet
Pass
Audited by Gen Agent Trust Hub on May 4, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
subprocess.runacross several scripts, includingfinalize_pet_run.py,generate_pet_images.py, andrender_animation_videos.py, to automate asset processing. These calls are used to execute internal helper scripts and system utilities likeffmpegfor video rendering andcurlfor API requests. All commands are constructed using argument lists rather than shell strings, which effectively mitigates the risk of shell injection. - [EXTERNAL_DOWNLOADS]: The fallback generation script
generate_pet_images.pymakes network requests to the OpenAI API (api.openai.com) viacurl. This is used to generate image assets when the primary system skill is unavailable. The interaction is consistent with the skill's purpose and targets a well-known, trusted service. - [SAFE]: No malicious patterns such as credential harvesting, unauthorized data exfiltration, or safety bypass instructions were identified. The skill's directory operations are localized to a dedicated application folder (
~/.codex), and its logic is transparently documented and aligned with its intended functionality of asset creation.
Audit Metadata