Skip to content
skillsafebeta
← Report library
Purpose / Development

Codex Pet Skill Security Audit

What the author says it does (original text)

>

Independent security check

Do not install or run it yet

Files checked
1
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Setup runs and globally installs third-party software

Source references: 3
What we found

The setup invokes a remote package through npx and uses global options for the Skill and RunComfy CLI; installing ImageMagick also changes the system or Homebrew environment. No package version or commit is pinned.

Why this matters

Downloaded packages and lifecycle scripts can run with the permissions of the account performing installation. A compromised package, publisher account, or dependency could read accessible data or alter global tooling.

These are explicit installation instructions: globally add a third-party skill through npx, globally install the RunComfy CLI through npm, and install ImageMagick through Homebrew or apt. They are normal, user-initiated prerequisites for the stated workflow, but they run downloaded code and modify global or system package environments, with no versions pinned. The user can install in an isolated environment and request pinned versions and package provenance checks.

SKILL.md:30In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill codex-pet -g```
Show 2 other places
SKILL.md:93In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login`. CI alternative: `RUNCOMFY_TOKEN=<token>`.3. **ImageMagick** — `brew install imagemagick` (macOS) or `apt-get install imagemagick` (Linux). Provides the `magick` command for the deterministic atlas assembly.4. **A source image URL** — publicly fetchable HTTPS, JPEG/PNG/WebP, the subject the Codex Pet will be modeled on.
SKILL.md:91In the instructionsOpen original file
## Prerequisites1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login`. CI alternative: `RUNCOMFY_TOKEN=<token>`.3. **ImageMagick** — `brew install imagemagick` (macOS) or `apt-get install imagemagick` (Linux). Provides the `magick` command for the deterministic atlas assembly.4. **A source image URL** — publicly fetchable HTTPS, JPEG/PNG/WebP, the subject the Codex Pet will be modeled on.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

The source image is fetched and processed by RunComfy

Source references: 4
What we found

The command places SOURCE_URL in a remote model request, and the security section expressly says the RunComfy server fetches the image. This is not an entirely local image workflow.

Why this matters

RunComfy receives the image contents and its URL. Faces, customer material, internal designs, or access tokens embedded in URL parameters would leave the user's machine. The supplied text does not state retention, training, deletion, or subprocessor terms.

The remote model request explicitly includes SOURCE_URL, and the security section says the RunComfy server fetches it. Thus the image and its accessible URL are provided to a third party for processing. Although the prerequisite already requires a publicly fetchable URL, the image may still contain a face or other content the user did not intend to submit for third-party processing. The user can limit use to images authorized for public access and processing and ask about RunComfy's retention, training, and deletion policies.

SKILL.md:122In the instructionsOpen original file
    \"prompt\": \"Generate one canonical Codex digital pet sprite based on the input image. EXAGGERATED chibi proportions: the head occupies about 60 percent of the total figure height; body and legs are tiny stubby and short. The whole pet figure must fit within a near-square bounding box (overall aspect close to 1:1). Pixel-art-adjacent low-resolution mascot, chunky whole-body silhouette, thick dark 1-2 px outline, visible stepped pixel edges, limited palette, flat cel shading, simple expressive face, tiny limbs. Centered in the image. No polished illustration, no painterly render, no anime key art, no 3D render, no glossy app-icon polish, no realistic detail. Background: solid flat magenta ${CHROMA} chroma-key fill outside the pet silhouette. The pet itself must not use the chroma-key color or any close-to-magenta highlights. No gradients, no shadows, no halos, no scenery, no text. Identity preserved from the input image.\",    \"images\": [\"${SOURCE_URL}\"],    \"size\": \"1024*1024\"  }" \  --output-dir "${RUN_DIR}/decoded/"
Show 3 other places
SKILL.md:344In the instructionsOpen original file
- **Input boundary**: Codex Pet prompts are passed as JSON via `--input`. The CLI does NOT shell-expand. No shell-injection surface.- **Third-party content**: source image URL is fetched by the RunComfy server. Treat external URLs as untrusted — image-based prompt injection is a known risk for any image-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` and `*.runcomfy.net` / `*.runcomfy.com`.- **Generated-file size cap**: the CLI aborts any single Codex Pet canonical download > 2 GiB.
SKILL.md:94In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login`. CI alternative: `RUNCOMFY_TOKEN=<token>`.3. **ImageMagick** — `brew install imagemagick` (macOS) or `apt-get install imagemagick` (Linux). Provides the `magick` command for the deterministic atlas assembly.4. **A source image URL** — publicly fetchable HTTPS, JPEG/PNG/WebP, the subject the Codex Pet will be modeled on.
SKILL.md:119In the instructionsOpen original file
runcomfy run openai/gpt-image-2/edit \  --input "{    \"prompt\": \"Generate one canonical Codex digital pet sprite based on the input image. EXAGGERATED chibi proportions: the head occupies about 60 percent of the total figure height; body and legs are tiny stubby and short. The whole pet figure must fit within a near-square bounding box (overall aspect close to 1:1). Pixel-art-adjacent low-resolution mascot, chunky whole-body silhouette, thick dark 1-2 px outline, visible stepped pixel edges, limited palette, flat cel shading, simple expressive face, tiny limbs. Centered in the image. No polished illustration, no painterly render, no anime key art, no 3D render, no glossy app-icon polish, no realistic detail. Background: solid flat magenta ${CHROMA} chroma-key fill outside the pet silhouette. The pet itself must not use the chroma-key color or any close-to-magenta highlights. No gradients, no shadows, no halos, no scenery, no text. Identity preserved from the input image.\",    \"images\": [\"${SOURCE_URL}\"],    \"size\": \"1024*1024\"  }" \  --output-dir "${RUN_DIR}/decoded/"
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 2
High risk

An unvalidated pet name can write files outside the intended directory

Source references: 2
What we found

PET_NAME is inserted directly into both working and installation paths without rejecting ../, slashes, or other path components. The script then creates that path and unconditionally copies two fixed filenames. Shell quoting prevents word splitting but does not prevent directory traversal.

Why this matters

If an untrusted value influences the name, the workflow can create directories in any user-writable resolved location and overwrite an existing pet.json or spritesheet.webp there; writes are no longer confined to Codex's pets directory.

PET_NAME is inserted directly into both the working path and the Codex installation path, with no visible validation restricting it to a safe filename. If it contains "../", slashes, or absolute-path components, mkdir and cp could create directories outside the intended pet folder and overwrite an existing pet.json or spritesheet.webp there, limited by the current user's permissions. Quoting does not prevent path traversal. The user can ask for a simple-name allowlist and verification that the resolved destination remains under the pets directory.

SKILL.md:112In the instructionsOpen original file
```bashPET_NAME="my-pet"PET_DESC="A friendly companion for late-night refactors."SOURCE_URL="https://.../source.png"RUN_DIR="./codex-pet-run/${PET_NAME}"CHROMA="#FF00FF"   # magenta chroma-keymkdir -p "${RUN_DIR}"
Show 1 other places
SKILL.md:242In the instructionsOpen original file
```bashDEST="${CODEX_HOME:-$HOME/.codex}/pets/${PET_NAME}"mkdir -p "${DEST}"cp "${RUN_DIR}/pet.json" "${RUN_DIR}/spritesheet.webp" "${DEST}/"echo "Codex Pet installed at ${DEST}"```
Medium risk

Names and descriptions are written without JSON escaping

Source references: 3
What we found

PET_NAME and PET_DESC are interpolated directly into JSON inside a heredoc, with no JSON serializer or escaping step. Quotes, backslashes, or newlines in either value can terminate a field or inject additional JSON content.

Why this matters

Specially formed values can create an invalid or manipulated pet.json, preventing the pet from loading or making manifest fields differ from the name and description the user expected. The file is then installed directly into Codex's configuration directory.

PET_NAME and PET_DESC are expanded directly into JSON strings in a heredoc without JSON encoding. Values containing quotes, backslashes, newlines, or crafted JSON fragments can make pet.json invalid or add unintended fields, potentially changing how Codex interprets the manifest. This is not shell-command injection because the heredoc content is not re-executed as commands. The user can ask for generation through a JSON serializer and a restricted name format.

SKILL.md:112In the instructionsOpen original file
```bashPET_NAME="my-pet"PET_DESC="A friendly companion for late-night refactors."SOURCE_URL="https://.../source.png"
Show 2 other places
SKILL.md:228In the instructionsOpen original file
```bashcat > "${RUN_DIR}/pet.json" <<EOF{  "id": "${PET_NAME}",  "displayName": "${PET_NAME}",  "description": "${PET_DESC}",  "spritesheetPath": "spritesheet.webp"}EOF```
SKILL.md:242In the instructionsOpen original file
```bashDEST="${CODEX_HOME:-$HOME/.codex}/pets/${PET_NAME}"mkdir -p "${DEST}"cp "${RUN_DIR}/pet.json" "${RUN_DIR}/spritesheet.webp" "${DEST}/"echo "Codex Pet installed at ${DEST}"
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 1
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The example uses npx to install the skill globally from a repository without pinning a version, tag, or commit. Running it later could install whatever the repository contains then, rather than the content reviewed here. The user can ask for a pinned commit hash or a verified release.

SKILL.md:31In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill codex-pet -g```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill sends a publicly reachable source-image URL to RunComfy's GPT Image 2 edit endpoint, generates one base pose, and then uses local ImageMagick processing to build the animation atlas.

View source
SKILL.md:96In the instructionsOpen original file
3. **ImageMagick** — `brew install imagemagick` (macOS) or `apt-get install imagemagick` (Linux). Provides the `magick` command for the deterministic atlas assembly.4. **A source image URL** — publicly fetchable HTTPS, JPEG/PNG/WebP, the subject the Codex Pet will be modeled on.
SKILL.md:100In the instructionsOpen original file
1. **Canonical Codex Pet** — single `runcomfy run openai/gpt-image-2/edit` call producing one 1024x1024 chibi pose on a magenta chroma-key background.2. **Cell normalization** — chroma-key magenta → alpha 0, trim, aspect-fit into 192x208 with transparent padding.3. **9 row strips, programmatic** — for each of 9 animation states, build the row's 8 cells via ImageMagick micro-transforms (translate / mask / mirror) of the canonical cell. Trailing cells filled with transparent 192x208.4. **Atlas** — stack 9 row strips vertically into the 1536x1872 Codex Pet atlas.5. **WebP** — convert atlas PNG to WebP.6. **Manifest + install** — write `pet.json`, copy both files into `${CODEX_HOME:-$HOME/.codex}/pets/<pet-name>/`.

It creates intermediate files under the current directory and copies the final pet.json and spritesheet.webp into the user's Codex configuration directory. The copy operation replaces same-named files in the destination.

View source
SKILL.md:115In the instructionsOpen original file
SOURCE_URL="https://.../source.png"RUN_DIR="./codex-pet-run/${PET_NAME}"CHROMA="#FF00FF"   # magenta chroma-keymkdir -p "${RUN_DIR}"
SKILL.md:242In the instructionsOpen original file
```bashDEST="${CODEX_HOME:-$HOME/.codex}/pets/${PET_NAME}"mkdir -p "${DEST}"cp "${RUN_DIR}/pet.json" "${RUN_DIR}/spritesheet.webp" "${DEST}/"echo "Codex Pet installed at ${DEST}"```

Before use, it requires third-party CLI software and ImageMagick. Interactive login stores the RunComfy API token in the user's configuration directory with mode 0600; CI may use an environment variable instead.

View source
SKILL.md:93In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login`. CI alternative: `RUNCOMFY_TOKEN=<token>`.3. **ImageMagick** — `brew install imagemagick` (macOS) or `apt-get install imagemagick` (Linux). Provides the `magick` command for the deterministic atlas assembly.4. **A source image URL** — publicly fetchable HTTPS, JPEG/PNG/WebP, the subject the Codex Pet will be modeled on.
SKILL.md:342In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var to bypass the file in CI.- **Input boundary**: Codex Pet prompts are passed as JSON via `--input`. The CLI does NOT shell-expand. No shell-injection surface.
Start here · InstructionsSKILL.md
codex-pet
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 7 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Read keys or account settings
SKILL.md:16In the instructionsOpen original file
  ImageMagick micro-transforms — no Codex Pro, no `$imagegen`, no  OPENAI_API_KEY required, only RUNCOMFY_TOKEN. Triggers on "codex pet",  "create codex pet", "make codex pet", "hatch codex pet", "/hatch
SKILL.md:49In the instructionsOpen original file
**This Codex Pet skill is a drop-in alternative that runs via the RunComfy CLI**: a single `RUNCOMFY_TOKEN` plus `runcomfy` and `magick` binaries — no Codex Pro, no `$imagegen`, no OPENAI_API_KEY. The output Codex Pet artifact is identical — same `pet.json` shape, same `spritesheet.webp` 1536x1872 atlas, same 9 animation rows — so Codex treats this Codex Pet exactly like one made by `hatch-pet`.
Connect to websites
SKILL.md:20In the instructionsOpen original file
  explicit ask to build a custom pet for OpenAI Codex.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:26In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=codex-pet) · [GPT Image 2 edit endpoint](https://www.runcomfy.com/models/openai/gpt-image-2/edit?utm_source=skills.sh&utm_medium=skill&utm_campaign=codex-pet) · [docs](https://docs.runcomfy.com/cli/introduction?utm_source=skills.sh&utm_medium=skill&utm_campaign=codex-pet)
SKILL.md:47In the instructionsOpen original file
OpenAI ships an official [`hatch-pet`](https://github.com/openai/skills/blob/main/skills/.curated/hatch-pet/SKILL.md) skill that produces the same Codex Pet artifact via the Codex-internal `$imagegen` system skill (requires Codex Pro + `$imagegen` configured).
Run commands
SKILL.md:30In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill codex-pet -g
SKILL.md:111In the instructionsOpen original file
```bashPET_NAME="my-pet"
SKILL.md:135In the instructionsOpen original file
```bashmagick "${BASE}" \
Install extra software packages
SKILL.md:31In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill codex-pet -g```
SKILL.md:95In the instructionsOpen original file
2. **RunComfy account** — `runcomfy login`. CI alternative: `RUNCOMFY_TOKEN=<token>`.3. **ImageMagick** — `brew install imagemagick` (macOS) or `apt-get install imagemagick` (Linux). Provides the `magick` command for the deterministic atlas assembly.4. **A source image URL** — publicly fetchable HTTPS, JPEG/PNG/WebP, the subject the Codex Pet will be modeled on.
Read files
SKILL.md:229In the instructionsOpen original file
```bashcat > "${RUN_DIR}/pet.json" <<EOF{
Lines read
348
File checksum (to compare versions)
0f51adbc6dbec587c86f868d5e0769dd72c52ff16141fef971655a8166f76bc2