hatch-pet
Creates and packages Codex-compatible animated pets from various visual inputs, ensuring quality and brand alignment.
Install this skill
Security score
The hatch-pet skill was audited on Jun 14, 2026 and we found 10 security issues across 2 threat categories, including 4 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 20 | ```text |
Template literal with variable interpolation in command context
| 32 | The built-in `$imagegen` path stores generated PNG bytes in the rollout that invokes it, even when it also writes a file under `${CODEX_HOME:-$HOME/.codex}/generated_images`. Deleting files later redu |
Template literal with variable interpolation in command context
| 37 | - After copying the selected generated output into `decoded/`, remove the selected original from `${CODEX_HOME:-$HOME/.codex}/generated_images` when it lives there, then remove its now-empty generatio |
Template literal with variable interpolation in command context
| 173 | ```bash |
Template literal with variable interpolation in command context
| 237 | If the copied source is under `${CODEX_HOME:-$HOME/.codex}/generated_images`, delete the original generated file after the decoded copy exists: |
Template literal with variable interpolation in command context
| 239 | ```bash |
Template literal with variable interpolation in command context
| 346 | ```text |
Template literal with variable interpolation in command context
| 354 | ```bash |
Template literal with variable interpolation in command context
| 539 | - `${CODEX_HOME:-$HOME/.codex}/pets/<pet-name>/pet.json` and `${CODEX_HOME:-$HOME/.codex}/pets/<pet-name>/spritesheet.webp` are staged together for custom pets. |
External URL reference
| 184 | --brand-source "https://example.com/source" \ |