skills/nexu-io/open-design/hatch-pet/Gen Agent Trust Hub

hatch-pet

Pass

Audited by Gen Agent Trust Hub on May 18, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill orchestrates a series of internal utility scripts and external tools like ffmpeg using the subprocess module. These operations are conducted using the list-based argument format, which is a secure practice that prevents shell injection. The invoked scripts are part of the skill's local directory and are used for processing image frames and rendering preview videos.
  • [EXTERNAL_DOWNLOADS]: The skill fetches assets and interacts with APIs from OpenAI, which is a well-known and trusted service. This includes downloading image data when the secondary fallback mechanism is activated and referencing documentation from OpenAI's public GitHub repositories.
  • [DATA_EXFILTRATION]: The skill accesses and processes local image files provided as references. It incorporates robust path traversal defenses, as seen in scripts/generate_pet_images.py and verified by dedicated regression tests in scripts/test_generate_pet_images.py, ensuring that the skill only interacts with files within its authorized project and pet directories.
Audit Metadata
Risk Level
SAFE
Analyzed
May 18, 2026, 09:41 AM