hatch-pet
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill processes user descriptions and brand information from web searches to generate image prompts. While this involves processing untrusted external content, the risk is limited to the visual generation process and is consistent with the skill's purpose. Ingestion points: user-supplied pet names and descriptions, and web search results. Boundary markers: specific worker prompts and identity locks guide the generation process. Capability inventory: local file system operations, shell utilities, and image generation tools. Sanitization: basic string cleaning and slugification.
- Local Script Execution: The skill utilizes bundled Python scripts for image processing tasks like atlas composition. These scripts use standard libraries and operate within the user-defined project directory.
Audit Metadata