hatch-pet
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates a series of internal utility scripts and external tools like
ffmpegusing thesubprocessmodule. These operations are conducted using the list-based argument format, which is a secure practice that prevents shell injection. The invoked scripts are part of the skill's local directory and are used for processing image frames and rendering preview videos. - [EXTERNAL_DOWNLOADS]: The skill fetches assets and interacts with APIs from OpenAI, which is a well-known and trusted service. This includes downloading image data when the secondary fallback mechanism is activated and referencing documentation from OpenAI's public GitHub repositories.
- [DATA_EXFILTRATION]: The skill accesses and processes local image files provided as references. It incorporates robust path traversal defenses, as seen in
scripts/generate_pet_images.pyand verified by dedicated regression tests inscripts/test_generate_pet_images.py, ensuring that the skill only interacts with files within its authorized project and pet directories.
Audit Metadata