skills/openai/skills/hatch-pet/Gen Agent Trust Hub

hatch-pet

Pass

Audited by Gen Agent Trust Hub on May 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • Local Command Execution: The skill utilizes subprocess.run to orchestrate several internal Python scripts and system tools such as ffmpeg. This architecture is used to handle deterministic image processing tasks, including spritesheet assembly, frame validation, and video rendering for user previews.
  • External Service Interaction: The inclusion of generate_pet_images.py allows the skill to communicate with the OpenAI Image API via curl. This is implemented as a secondary generation path and involves sending prompts and reference images to the API. This interaction is expected given the skill's purpose and its authorship by OpenAI.
  • User Input Integration (Indirect Prompt Injection Surface): The skill accepts user-defined concepts, names, and descriptions which are then interpolated into image generation prompts. To manage this, the skill employs detailed prompt templates and identity constraints. While this is a standard operational pattern, it constitutes an indirect injection surface where user-provided text can influence the visual output of the subagents and generation tools.
Audit Metadata
Risk Level
SAFE
Analyzed
May 13, 2026, 05:24 AM