scenario-chatgpt-pet-create
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input, such as pet descriptions and notes, and interpolates them into prompts for image generation models. This content is then used to create assets that the skill installs in local application directories, representing an indirect prompt injection attack surface.
- Ingestion points: User-provided notes and descriptions are ingested through command-line arguments in
pet_prepare.pyand stored inrequest.json. - Boundary markers: The prompt templates in
pet_prepare.pyinclude instructional segments but do not employ delimiters or ignore-instructions warnings to isolate user-controlled strings. - Capability inventory: The skill has the capability to write and replace folders within the
~/.codex/pets/directory usingpet_package.py. - Sanitization: User-provided strings are not sanitized or escaped before being interpolated into the model prompts.
Audit Metadata