Skills codex-pet
🦀

codex-pet

Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Build Custom Codex Pets from Any Image

Also available from: agentspace-so

Create a custom animated Codex pet spritesheet from a single reference image. The skill generates pixel-art style companions with 9 animation states using RunComfy GPT Image 2 API and ImageMagick. Drop the result into your Codex pets folder for a personalized desktop companion.

Supports: Claude Codex Code(CC)
⚠️ 64 Poor
1

Download the skill ZIP

2

Upload in Claude

Go to Settings → Capabilities → Skills → Upload skill

3

Toggle on and start using

Test it

Using "codex-pet". Create a codex pet from https://example.com/photo.jpg

Expected outcome:

Generated pet 'my-pet' installed at ~/.codex/pets/my-pet/ with spritesheet.webp (1536x1872, 9 animation rows) and pet.json manifest. Restart Codex to see the new pet in your selection.

Using "codex-pet". Make a codex pet named ninja-cat from https://example.com/cat.png with description 'A stealthy feline companion'

Expected outcome:

Codex Pet 'ninja-cat' created and installed. Spritesheet includes idle, running-right, running-left, waving, jumping, failed, waiting, running, and review animation states. All cells follow required frame counts per Codex specification.

Using "codex-pet". Adjust my-pet animation to have bigger idle movement

Expected outcome:

Idle row modified: shift changed from shift:0:-1 to shift:0:-2 for stronger breathing effect. Updated spritesheet.webp written to ~/.codex/pets/my-pet/. Reload Codex to preview changes.

Security Audit

Medium Risk
v1 • 5/28/2026

This is a legitimate Codex Pet generator that uses RunComfy CLI and ImageMagick to create animated pet spritesheets. The static analysis flagged many patterns (97 command usages, filesystem access) but these are all legitimate tool invocations. The external commands (`runcomfy run`, `magick`) use hardcoded arguments derived from skill logic, not user-controlled shell input. Network calls go only to runcomfy.net endpoints. Path traversal in PET_NAME is a low concern as writes are scoped to the ~/.codex/pets sandbox. Environment variable access is explicit and documented (RUNCOMFY_TOKEN). No credential exfiltration, no data theft patterns, no command injection vectors confirmed. Skill performs exactly what it claims: generates pet spritesheets via API + ImageMagick transforms.

1
Files scanned
348
Lines analyzed
7
findings
1
Total audits
Medium Risk Issues (1)
Path Injection via PET_NAME in mkdir/cp Commands
PET_NAME user input is interpolated into mkdir and cp paths without sanitization. A malicious PET_NAME like '../../etc' could escape the intended ~/.codex/pets/ directory. This is a LOW-to-MEDIUM risk because: (1) writes are scoped to local filesystem only, (2) no privilege escalation apparent, (3) Codex pet directories are user-controlled workspace. However, the shell commands at lines 242-245 concatenate PET_NAME directly into mkdir/cp with no validation.
Low Risk Issues (2)
Hidden File in Home Directory Access
Skill accesses ~/.config/runcomfy/token.json to store API credentials. This is standard configuration file access for authenticated CLI tools, documented openly in the Security & Privacy section. Not a security vulnerability but worth noting for transparency.
External URL fetch in Image Processing Pipeline
The skill accepts a SOURCE_URL parameter and fetches external images. This is standard for image generation workflows but introduces a data boundary concern: external images are processed by RunComfy's servers. Documented as a known risk.
Audited by: claude

Quality Score

38
Architecture
100
Maintainability
87
Content
42
Community
56
Security
83
Spec Compliance

What You Can Build

Build a Personal Codex Companion

Take a photo of yourself, your pet, or a character and turn it into a Codex desktop companion. The skill transforms your image into chibi-style pixel art that floats over your code editor.

Batch Generate Pet Spritesheets

Process multiple source images to create several Codex Pets for a team. Each pet installs alongside Codex built-ins so anyone in the team can select their favorite.

Prototype New Pet Animations

Quickly generate and test custom animation timings for pet rows. Tweak ImageMagick micro-transform values to adjust animation feel without regenerating the entire spritesheet.

Try These Prompts

Basic Pet Generation
Create a codex pet from this image: [SOURCE_IMAGE_URL]
Named Pet with Description
Make me a codex pet named [PET_NAME] based on [IMAGE_URL]. Description: [PET_DESCRIPTION]
Custom Animation Tweaks
Adjust [PET_NAME] animation: change idle bob to shift:0:-2, make running cycle faster with shift:3:0
Debug Failed Generation
Retry generating [PET_NAME] with tighter identity preservation: emphasize [SPECIFIC_FEATURES] from original image

Best Practices

  • Use square or near-square source images for best fit in the 192x208 pixel cells
  • Choose images with clear silhouettes and simple color palettes for clean chroma-key processing
  • When identity preservation matters, describe specific features in the prompt refinement

Avoid

  • Do not use source images with magenta backgrounds (conflicts with chroma-key placeholder)
  • Avoid feeding complex multi-character scenes as a single source image
  • Do not skip backtick code blocks when installing via skills CLI

Frequently Asked Questions

How is this different from OpenAI's hatch-pet skill?
This skill uses Google's RunComfy CLI instead of Codex Pro's $imagegen system. It needs only RUNCOMFY_TOKEN, not Codex Pro access. The output format is identical so Codex treats both the same.
Why does the animation use ImageMagick transforms instead of generating distinct frames?
Codex's built-in pets use the same approach. The animation is intentionally subtle. One canonical pose plus 1-2 px transforms produces the same effect without generating 72 separate images.
What happens if my source image has near-magenta colors?
Switch the chroma-key from #FF00FF to cyan (#00FFFF) or green (#00FF00). Update both the prompt and the post-process fuzz threshold.
Can I use this without a RunComfy account?
No, a RunComfy account with API token is required. The skill calls the RunComfy GPT Image 2 edit endpoint as its image generation backend.
Where does the pet get installed?
Files are written to ${CODEX_HOME:-$HOME/.codex}/pets/<pet-name>/. Restart Codex or reload the pet list to see the new custom pet.
Why does the skill say it uses weak cryptographic algorithms?
This refers to the intentionally simple ImageMagick transforms (translate, rotate) used for animation. They are NOT cryptographic algorithms. ImageMagick is an image processing tool, not a cryptography library.

Developer Details

File structure

📄 SKILL.md