codex-pet
Generates custom Codex Pets from a reference image using RunComfy, creating spritesheets and JSON manifests for seamless integration.
Install this skill
Security score
The codex-pet skill was audited on May 14, 2026 and we found 18 security issues across 3 threat categories, including 8 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 7 | into `${CODEX_HOME:-$HOME/.codex}/pets/<name>/` and Codex picks it up |
Template literal with variable interpolation in command context
| 28 | **Codex Pet generator on RunComfy.** Turn one source image into a Codex-compatible custom Codex Pet — `pet.json` + `spritesheet.webp` — drop it into `${CODEX_HOME:-$HOME/.codex}/pets/<name>/`, Codex p |
Template literal with variable interpolation in command context
| 36 | OpenAI Codex Pets (released May 2026) are pixel-art animated companions that float over your desktop while Codex codes — they react to mouse interaction and Codex status (scratching head when thinking |
Template literal with variable interpolation in command context
| 105 | 6. **Manifest + install** — write `pet.json`, copy both files into `${CODEX_HOME:-$HOME/.codex}/pets/<pet-name>/`. |
Template literal with variable interpolation in command context
| 111 | ```bash |
Template literal with variable interpolation in command context
| 135 | ```bash |
Template literal with variable interpolation in command context
| 153 | ```bash |
Template literal with variable interpolation in command context
| 210 | ```bash |
Template literal with variable interpolation in command context
| 228 | ```bash |
Template literal with variable interpolation in command context
| 241 | ```bash |
Template literal with variable interpolation in command context
| 282 | **What is a Codex Pet?** OpenAI Codex Pets are pixel-art animated companions launched May 2026 that float over your desktop and react to Codex's coding status. Custom Codex Pets live as `pet.json` + ` |
Template literal with variable interpolation in command context
| 292 | **How do I install my Codex Pet?** Copy `pet.json` and `spritesheet.webp` into `${CODEX_HOME:-$HOME/.codex}/pets/<pet-name>/` and reload Codex. |
Template literal with variable interpolation in command context
| 330 | 5. A `pet.json` manifest is written; both files are copied into `${CODEX_HOME:-$HOME/.codex}/pets/<name>/` where Codex picks up the custom Codex Pet automatically. |
Template literal with variable interpolation in command context
| 347 | - **Local install path**: the final Codex Pet writes to `${CODEX_HOME:-$HOME/.codex}/pets/<pet-name>/`. No remote upload. |
Access to hidden dotfiles in home directory
| 342 | - **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var to bypass the file in CI. |
External URL reference
| 20 | homepage: https://www.runcomfy.com |
External URL reference
| 26 | [runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=codex-pet) · [GPT Image 2 edit endpoint](https://www.runcomfy.com/models/openai/gpt-image-2/edit?utm_source= |
External URL reference
| 114 | SOURCE_URL="https://.../source.png" |