📦
Audit History
codex-pet - 6 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v6 Latest | Jul 9, 2026, 12:03 PM | 2 confirmed | 14 | No capability change |
| v5 | Jul 9, 2026, 12:03 PM | 2 confirmed | 14 | No capability change |
| v4 | Jul 5, 2026, 09:22 PM | 2 confirmed | 29 | No capability change |
| v3 | Jul 5, 2026, 09:22 PM | 2 confirmed | 29 | No capability change |
| v2 | Jun 30, 2026, 10:45 AM | No confirmed findings | 4 | No capability change |
| v1 | May 28, 2026, 09:27 AM | 1 confirmed | 2 | Baseline |
Audit version 6 Latest
Jul 9, 2026, 12:03 PM
Most static alerts are Markdown formatting false positives, not executable Ruby backticks or hidden behavior. The skill intentionally asks users to run RunComfy and ImageMagick commands, sends a source image URL to a third-party service, and writes assets into the Codex pets directory. The main actionable issue is unvalidated PET_NAME usage in local paths.
1
Files scanned
348
Lines analyzed
20
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Third-Party Image Processing Requires Consent
The RunComfy command sends the source image URL and prompt to a remote model service. Private images or signed URLs could leave the local trust boundary.
The command includes SOURCE_URL in the RunComfy request, and the security notes state that the RunComfy server fetches third-party content. The behavior is disclosed, but it is still a privacy boundary.
Medium
Unvalidated Pet Name Controls Install Path
PET_NAME is inserted into RUN_DIR and DEST without validation. A name containing path separators can move writes outside the intended pet folder.
The shell recipe builds directories directly from PET_NAME and then runs mkdir and cp. The default value is safe, but the instructions do not constrain user-supplied names.
Capability review items (14)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
SKILL.md:30-32SKILL.md:111-129SKILL.md:135-145SKILL.md:153-202SKILL.md:210-224SKILL.md:228-237SKILL.md:241-246
Ruby/shell backtick execution · 7 occurrences
```bash
The fenced shell block instructs a global skill install through npx from a community repository. It is user-visible, but it can modify the local Codex skills environment and should require confirmation.
Medium
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
This prerequisite asks the user to install a global CLI package. Package installation is expected, but it executes third-party installer code on the host.
Medium
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login`. CI alternative: `RUNCOMFY_TOKEN=<token>`.
This prerequisite invokes runcomfy login or a token environment variable. It is documented, but it handles credentials and should not be automated without user consent.
Medium
Ruby/shell backtick execution
3. **ImageMagick** — `brew install imagemagick` (macOS) or `apt-get install imagemagick` (Linux). Pr
This prerequisite asks the user to install ImageMagick through system package managers. It is expected setup, but it changes system packages and should be user-approved.
Medium
Ruby/shell backtick execution
1. **Canonical Codex Pet** — single `runcomfy run openai/gpt-image-2/edit` call producing one 1024x1
This describes a RunComfy CLI call that sends a source image request to a remote model endpoint. It is core functionality, but it is a real external command and network action.
Medium
Template literal with command substitution · 2 occurrences
```bash
The shell recipe interpolates SOURCE_URL, RUN_DIR, and CHROMA into the RunComfy CLI payload. It is visible and intended, but unsafe values can affect remote processing inputs and output paths.
Medium
Hidden file access
DEST="${CODEX_HOME:-$HOME/.codex}/pets/${PET_NAME}"
DEST points under ${CODEX_HOME:-$HOME/.codex} and includes PET_NAME before mkdir and cp. This is an intended install path, but without pet-name validation it can write outside the expected pets directory.
Risk Factors
⚙️ External commands (50)
SKILL.md:7 SKILL.md:13 SKILL.md:15 SKILL.md:28 SKILL.md:30-32 SKILL.md:32-36 SKILL.md:36-40 SKILL.md:40 SKILL.md:41-45 SKILL.md:45-47 SKILL.md:47 SKILL.md:49 SKILL.md:51-55 SKILL.md:55-93 SKILL.md:93-94 SKILL.md:94 SKILL.md:95 SKILL.md:100-105 SKILL.md:105 SKILL.md:111-129 SKILL.md:129-135 SKILL.md:135-145 SKILL.md:145-153 SKILL.md:153-202 SKILL.md:202-210 SKILL.md:210-224 SKILL.md:224-228 SKILL.md:228-237 SKILL.md:237-241 SKILL.md:241-246 SKILL.md:246-256 SKILL.md:256-273 SKILL.md:273 SKILL.md:274 SKILL.md:275 SKILL.md:276 SKILL.md:282 SKILL.md:284 SKILL.md:292 SKILL.md:298-303 SKILL.md:303 SKILL.md:309-315 SKILL.md:315 SKILL.md:320-326 SKILL.md:326-330 SKILL.md:330 SKILL.md:334 SKILL.md:338 SKILL.md:342 SKILL.md:343-345
🌐 Network access (6)
📁 Filesystem access (14)
🔑 Env variables (2)
Audited by: codex
Jul 9, 2026, 12:03 PM
Most static alerts are Markdown formatting false positives, not executable Ruby backticks or hidden behavior. The skill intentionally asks users to run RunComfy and ImageMagick commands, sends a source image URL to a third-party service, and writes assets into the Codex pets directory. The main actionable issue is unvalidated PET_NAME usage in local paths.
1
Files scanned
348
Lines analyzed
20
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Third-Party Image Processing Requires Consent
The RunComfy command sends the source image URL and prompt to a remote model service. Private images or signed URLs could leave the local trust boundary.
The command includes SOURCE_URL in the RunComfy request, and the security notes state that the RunComfy server fetches third-party content. The behavior is disclosed, but it is still a privacy boundary.
Medium
Unvalidated Pet Name Controls Install Path
PET_NAME is inserted into RUN_DIR and DEST without validation. A name containing path separators can move writes outside the intended pet folder.
The shell recipe builds directories directly from PET_NAME and then runs mkdir and cp. The default value is safe, but the instructions do not constrain user-supplied names.
Capability review items (14)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
SKILL.md:30-32SKILL.md:111-129SKILL.md:135-145SKILL.md:153-202SKILL.md:210-224SKILL.md:228-237SKILL.md:241-246
Ruby/shell backtick execution · 7 occurrences
```bash
The fenced shell block instructs a global skill install through npx from a community repository. It is user-visible, but it can modify the local Codex skills environment and should require confirmation.
Medium
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
This prerequisite asks the user to install a global CLI package. Package installation is expected, but it executes third-party installer code on the host.
Medium
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login`. CI alternative: `RUNCOMFY_TOKEN=<token>`.
This prerequisite invokes runcomfy login or a token environment variable. It is documented, but it handles credentials and should not be automated without user consent.
Medium
Ruby/shell backtick execution
3. **ImageMagick** — `brew install imagemagick` (macOS) or `apt-get install imagemagick` (Linux). Pr
This prerequisite asks the user to install ImageMagick through system package managers. It is expected setup, but it changes system packages and should be user-approved.
Medium
Ruby/shell backtick execution
1. **Canonical Codex Pet** — single `runcomfy run openai/gpt-image-2/edit` call producing one 1024x1
This describes a RunComfy CLI call that sends a source image request to a remote model endpoint. It is core functionality, but it is a real external command and network action.
Medium
Template literal with command substitution · 2 occurrences
```bash
The shell recipe interpolates SOURCE_URL, RUN_DIR, and CHROMA into the RunComfy CLI payload. It is visible and intended, but unsafe values can affect remote processing inputs and output paths.
Medium
Hidden file access
DEST="${CODEX_HOME:-$HOME/.codex}/pets/${PET_NAME}"
DEST points under ${CODEX_HOME:-$HOME/.codex} and includes PET_NAME before mkdir and cp. This is an intended install path, but without pet-name validation it can write outside the expected pets directory.
Risk Factors
⚙️ External commands (50)
SKILL.md:7 SKILL.md:13 SKILL.md:15 SKILL.md:28 SKILL.md:30-32 SKILL.md:32-36 SKILL.md:36-40 SKILL.md:40 SKILL.md:41-45 SKILL.md:45-47 SKILL.md:47 SKILL.md:49 SKILL.md:51-55 SKILL.md:55-93 SKILL.md:93-94 SKILL.md:94 SKILL.md:95 SKILL.md:100-105 SKILL.md:105 SKILL.md:111-129 SKILL.md:129-135 SKILL.md:135-145 SKILL.md:145-153 SKILL.md:153-202 SKILL.md:202-210 SKILL.md:210-224 SKILL.md:224-228 SKILL.md:228-237 SKILL.md:237-241 SKILL.md:241-246 SKILL.md:246-256 SKILL.md:256-273 SKILL.md:273 SKILL.md:274 SKILL.md:275 SKILL.md:276 SKILL.md:282 SKILL.md:284 SKILL.md:292 SKILL.md:298-303 SKILL.md:303 SKILL.md:309-315 SKILL.md:315 SKILL.md:320-326 SKILL.md:326-330 SKILL.md:330 SKILL.md:334 SKILL.md:338 SKILL.md:342 SKILL.md:343-345
🌐 Network access (6)
📁 Filesystem access (14)
🔑 Env variables (2)
Audited by: codex
Jul 5, 2026, 09:22 PM
Most static detections are Markdown false positives, but the workflow still performs real external CLI, network, credential, and hidden filesystem operations. Confirmed risks include global package installation, RunComfy token use, image processing through third-party services, and writes into Codex configuration paths. I found no prompt injection attempt in the skill text.
1
Files scanned
348
Lines analyzed
35
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Unsanitized Pet Name Used in Filesystem Paths
PET_NAME is interpolated into RUN_DIR and DEST without validation. A name containing path traversal text could write generated files outside the intended pet folder.
The shell snippets use PET_NAME directly in directory paths and copy commands. The example value is safe, but the skill gives no validation rule for user-supplied names.
Medium
Third-Party Image Processing Boundary
The workflow sends a user-provided source image URL to RunComfy for remote GPT Image 2 processing. Confidential images or image-based prompt injection can cross this boundary.
The runcomfy command passes SOURCE_URL as image input, and the security section states external URLs are fetched by RunComfy. This is intentional but security-relevant.
Capability review items (29)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The skill documents token storage in ~/.config/runcomfy/token.json. Persisted API credentials in hidden files are sensitive even with restrictive permissions.
High
Generic API/secret keys
OPENAI_API_KEY required, only RUNCOMFY_TOKEN. Triggers on "codex pet",
The description says RUNCOMFY_TOKEN is required. No secret value is embedded, but the workflow depends on a live API credential.
High
Generic API/secret keys
**This Codex Pet skill is a drop-in alternative that runs via the RunComfy CLI**: a single `RUNCOMFY
The skill requires RUNCOMFY_TOKEN for the RunComfy CLI. Using a community workflow with an API token is a real credential-handling risk.
Medium
Ruby/shell backtick execution
`runcomfy run openai/gpt-image-2/edit` to produce a canonical Codex
The skill advertises running the RunComfy CLI for image generation. This is expected functionality, but it crosses an external command and network boundary.
Medium
SKILL.md:30-32SKILL.md:111-129SKILL.md:135-145SKILL.md:153-202SKILL.md:210-224SKILL.md:228-237SKILL.md:241-246
Ruby/shell backtick execution · 7 occurrences
```bash
The snippet instructs a global skill install through npx, which executes package manager code from an external source. Community package installation should require explicit user confirmation.
Medium
Ruby/shell backtick execution
**This Codex Pet skill is a drop-in alternative that runs via the RunComfy CLI**: a single `RUNCOMFY
The text requires the runcomfy and magick binaries plus a RunComfy token. Running credentialed third-party CLIs is a real security boundary.
Medium
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
The prerequisite tells users to install the RunComfy CLI globally with npm. Global package installation can modify the host environment and carries supply-chain risk.
Medium
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login`. CI alternative: `RUNCOMFY_TOKEN=<token>`.
The prerequisite instructs running runcomfy login or using RUNCOMFY_TOKEN. That invokes a local CLI with API credentials.
Medium
Ruby/shell backtick execution
3. **ImageMagick** — `brew install imagemagick` (macOS) or `apt-get install imagemagick` (Linux). Pr
The line instructs installing ImageMagick through system package managers. These commands alter the host environment and should require user confirmation.
Medium
Ruby/shell backtick execution
1. **Canonical Codex Pet** — single `runcomfy run openai/gpt-image-2/edit` call producing one 1024x1
The pipeline calls runcomfy run against a remote image generation model. This is intentional, but it is still external command execution with network effects.
Medium
Ruby/shell backtick execution
6. **Manifest + install** — write `pet.json`, copy both files into `${CODEX_HOME:-$HOME/.codex}/pets
The pipeline step describes writing a manifest and copying files into the Codex pet directory. It is expected, but it mutates the local filesystem.
Medium
Ruby/shell backtick execution
1. The skill calls `runcomfy run openai/gpt-image-2/edit` once with the user's source image and a ti
The workflow summary states the skill calls runcomfy with the source image. This confirms external command execution and third-party image processing.
Medium
Ruby/shell backtick execution
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The security section documents runcomfy login storing an API token locally. Credentialed CLI execution and token persistence are real security concerns.
Medium
Hidden file access
into `${CODEX_HOME:-$HOME/.codex}/pets/<name>/` and Codex picks it up
The description tells users to place generated artifacts under ${CODEX_HOME:-$HOME/.codex}/pets. This is intended, but it writes into hidden Codex configuration.
Medium
Hidden file access
**Codex Pet generator on RunComfy.** Turn one source image into a Codex-compatible custom Codex Pet
The introduction repeats the hidden Codex pets path as the install target. It is expected functionality, but it mutates a hidden application directory.
Medium
Hidden file access
OpenAI Codex Pets (released May 2026) are pixel-art animated companions that float over your desktop
The line documents custom Codex Pets as folders under ${CODEX_HOME:-$HOME/.codex}/pets. This confirms hidden directory use, though it is descriptive.
Medium
Hidden file access
6. **Manifest + install** — write `pet.json`, copy both files into `${CODEX_HOME:-$HOME/.codex}/pets
The pipeline explicitly says the manifest and sprite sheet are copied into ${CODEX_HOME:-$HOME/.codex}/pets. That is a hidden local configuration write.
Medium
Hidden file access
DEST="${CODEX_HOME:-$HOME/.codex}/pets/${PET_NAME}"
The install command builds DEST under ${CODEX_HOME:-$HOME/.codex}/pets/${PET_NAME}. This hidden-path write should validate PET_NAME and the resolved destination.
Medium
Hidden file access
**What is a Codex Pet?** OpenAI Codex Pets are pixel-art animated companions launched May 2026 that
The FAQ states custom pets live under ${CODEX_HOME:-$HOME/.codex}/pets/<name>. It is expected, but confirms reliance on hidden Codex configuration.
Medium
Hidden file access
**How do I install my Codex Pet?** Copy `pet.json` and `spritesheet.webp` into `${CODEX_HOME:-$HOME/
The FAQ instructs copying pet files into ${CODEX_HOME:-$HOME/.codex}/pets/<pet-name>. That is a hidden directory write and should require user consent.
Medium
Hidden file access
5. A `pet.json` manifest is written; both files are copied into `${CODEX_HOME:-$HOME/.codex}/pets/<n
The workflow summary says both files are copied into ${CODEX_HOME:-$HOME/.codex}/pets/<name>. This confirms local hidden configuration mutation.
Medium
Hidden file access
- **Local install path**: the final Codex Pet writes to `${CODEX_HOME:-$HOME/.codex}/pets/<pet-name>
The security section states the final pet writes to ${CODEX_HOME:-$HOME/.codex}/pets/<pet-name>. This is intended but still a hidden application directory write.
Low
Hardcoded URL
SOURCE_URL="https://.../source.png"
SOURCE_URL is a placeholder for a publicly fetchable image passed to RunComfy. The placeholder is not malicious, but the workflow depends on external network retrieval.
Risk Factors
⚙️ External commands (56)
SKILL.md:7 SKILL.md:13 SKILL.md:15 SKILL.md:28 SKILL.md:30-32 SKILL.md:32-36 SKILL.md:36-40 SKILL.md:40 SKILL.md:41-45 SKILL.md:45-47 SKILL.md:47 SKILL.md:49 SKILL.md:51-55 SKILL.md:55-93 SKILL.md:93-94 SKILL.md:94 SKILL.md:95 SKILL.md:100-105 SKILL.md:105 SKILL.md:111-129 SKILL.md:129-135 SKILL.md:135-145 SKILL.md:145-153 SKILL.md:153-202 SKILL.md:202-210 SKILL.md:210-224 SKILL.md:224-228 SKILL.md:228-237 SKILL.md:237-241 SKILL.md:241-246 SKILL.md:246-256 SKILL.md:256-273 SKILL.md:273 SKILL.md:274 SKILL.md:275 SKILL.md:276 SKILL.md:282 SKILL.md:284 SKILL.md:292 SKILL.md:298-303 SKILL.md:303 SKILL.md:309-315 SKILL.md:315 SKILL.md:320-326 SKILL.md:326-330 SKILL.md:330 SKILL.md:334 SKILL.md:338 SKILL.md:342 SKILL.md:343-345 SKILL.md:345 SKILL.md:127 SKILL.md:179 SKILL.md:183 SKILL.md:111-129 SKILL.md:153-202
🌐 Network access (6)
📁 Filesystem access (14)
🔑 Env variables (2)
Audited by: codex
Jul 5, 2026, 09:22 PM
Most static detections are Markdown false positives, but the workflow still performs real external CLI, network, credential, and hidden filesystem operations. Confirmed risks include global package installation, RunComfy token use, image processing through third-party services, and writes into Codex configuration paths. I found no prompt injection attempt in the skill text.
1
Files scanned
348
Lines analyzed
35
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Unsanitized Pet Name Used in Filesystem Paths
PET_NAME is interpolated into RUN_DIR and DEST without validation. A name containing path traversal text could write generated files outside the intended pet folder.
The shell snippets use PET_NAME directly in directory paths and copy commands. The example value is safe, but the skill gives no validation rule for user-supplied names.
Medium
Third-Party Image Processing Boundary
The workflow sends a user-provided source image URL to RunComfy for remote GPT Image 2 processing. Confidential images or image-based prompt injection can cross this boundary.
The runcomfy command passes SOURCE_URL as image input, and the security section states external URLs are fetched by RunComfy. This is intentional but security-relevant.
Capability review items (29)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The skill documents token storage in ~/.config/runcomfy/token.json. Persisted API credentials in hidden files are sensitive even with restrictive permissions.
High
Generic API/secret keys
OPENAI_API_KEY required, only RUNCOMFY_TOKEN. Triggers on "codex pet",
The description says RUNCOMFY_TOKEN is required. No secret value is embedded, but the workflow depends on a live API credential.
High
Generic API/secret keys
**This Codex Pet skill is a drop-in alternative that runs via the RunComfy CLI**: a single `RUNCOMFY
The skill requires RUNCOMFY_TOKEN for the RunComfy CLI. Using a community workflow with an API token is a real credential-handling risk.
Medium
Ruby/shell backtick execution
`runcomfy run openai/gpt-image-2/edit` to produce a canonical Codex
The skill advertises running the RunComfy CLI for image generation. This is expected functionality, but it crosses an external command and network boundary.
Medium
SKILL.md:30-32SKILL.md:111-129SKILL.md:135-145SKILL.md:153-202SKILL.md:210-224SKILL.md:228-237SKILL.md:241-246
Ruby/shell backtick execution · 7 occurrences
```bash
The snippet instructs a global skill install through npx, which executes package manager code from an external source. Community package installation should require explicit user confirmation.
Medium
Ruby/shell backtick execution
**This Codex Pet skill is a drop-in alternative that runs via the RunComfy CLI**: a single `RUNCOMFY
The text requires the runcomfy and magick binaries plus a RunComfy token. Running credentialed third-party CLIs is a real security boundary.
Medium
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
The prerequisite tells users to install the RunComfy CLI globally with npm. Global package installation can modify the host environment and carries supply-chain risk.
Medium
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login`. CI alternative: `RUNCOMFY_TOKEN=<token>`.
The prerequisite instructs running runcomfy login or using RUNCOMFY_TOKEN. That invokes a local CLI with API credentials.
Medium
Ruby/shell backtick execution
3. **ImageMagick** — `brew install imagemagick` (macOS) or `apt-get install imagemagick` (Linux). Pr
The line instructs installing ImageMagick through system package managers. These commands alter the host environment and should require user confirmation.
Medium
Ruby/shell backtick execution
1. **Canonical Codex Pet** — single `runcomfy run openai/gpt-image-2/edit` call producing one 1024x1
The pipeline calls runcomfy run against a remote image generation model. This is intentional, but it is still external command execution with network effects.
Medium
Ruby/shell backtick execution
6. **Manifest + install** — write `pet.json`, copy both files into `${CODEX_HOME:-$HOME/.codex}/pets
The pipeline step describes writing a manifest and copying files into the Codex pet directory. It is expected, but it mutates the local filesystem.
Medium
Ruby/shell backtick execution
1. The skill calls `runcomfy run openai/gpt-image-2/edit` once with the user's source image and a ti
The workflow summary states the skill calls runcomfy with the source image. This confirms external command execution and third-party image processing.
Medium
Ruby/shell backtick execution
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The security section documents runcomfy login storing an API token locally. Credentialed CLI execution and token persistence are real security concerns.
Medium
Hidden file access
into `${CODEX_HOME:-$HOME/.codex}/pets/<name>/` and Codex picks it up
The description tells users to place generated artifacts under ${CODEX_HOME:-$HOME/.codex}/pets. This is intended, but it writes into hidden Codex configuration.
Medium
Hidden file access
**Codex Pet generator on RunComfy.** Turn one source image into a Codex-compatible custom Codex Pet
The introduction repeats the hidden Codex pets path as the install target. It is expected functionality, but it mutates a hidden application directory.
Medium
Hidden file access
OpenAI Codex Pets (released May 2026) are pixel-art animated companions that float over your desktop
The line documents custom Codex Pets as folders under ${CODEX_HOME:-$HOME/.codex}/pets. This confirms hidden directory use, though it is descriptive.
Medium
Hidden file access
6. **Manifest + install** — write `pet.json`, copy both files into `${CODEX_HOME:-$HOME/.codex}/pets
The pipeline explicitly says the manifest and sprite sheet are copied into ${CODEX_HOME:-$HOME/.codex}/pets. That is a hidden local configuration write.
Medium
Hidden file access
DEST="${CODEX_HOME:-$HOME/.codex}/pets/${PET_NAME}"
The install command builds DEST under ${CODEX_HOME:-$HOME/.codex}/pets/${PET_NAME}. This hidden-path write should validate PET_NAME and the resolved destination.
Medium
Hidden file access
**What is a Codex Pet?** OpenAI Codex Pets are pixel-art animated companions launched May 2026 that
The FAQ states custom pets live under ${CODEX_HOME:-$HOME/.codex}/pets/<name>. It is expected, but confirms reliance on hidden Codex configuration.
Medium
Hidden file access
**How do I install my Codex Pet?** Copy `pet.json` and `spritesheet.webp` into `${CODEX_HOME:-$HOME/
The FAQ instructs copying pet files into ${CODEX_HOME:-$HOME/.codex}/pets/<pet-name>. That is a hidden directory write and should require user consent.
Medium
Hidden file access
5. A `pet.json` manifest is written; both files are copied into `${CODEX_HOME:-$HOME/.codex}/pets/<n
The workflow summary says both files are copied into ${CODEX_HOME:-$HOME/.codex}/pets/<name>. This confirms local hidden configuration mutation.
Medium
Hidden file access
- **Local install path**: the final Codex Pet writes to `${CODEX_HOME:-$HOME/.codex}/pets/<pet-name>
The security section states the final pet writes to ${CODEX_HOME:-$HOME/.codex}/pets/<pet-name>. This is intended but still a hidden application directory write.
Low
Hardcoded URL
SOURCE_URL="https://.../source.png"
SOURCE_URL is a placeholder for a publicly fetchable image passed to RunComfy. The placeholder is not malicious, but the workflow depends on external network retrieval.
Risk Factors
⚙️ External commands (56)
SKILL.md:7 SKILL.md:13 SKILL.md:15 SKILL.md:28 SKILL.md:30-32 SKILL.md:32-36 SKILL.md:36-40 SKILL.md:40 SKILL.md:41-45 SKILL.md:45-47 SKILL.md:47 SKILL.md:49 SKILL.md:51-55 SKILL.md:55-93 SKILL.md:93-94 SKILL.md:94 SKILL.md:95 SKILL.md:100-105 SKILL.md:105 SKILL.md:111-129 SKILL.md:129-135 SKILL.md:135-145 SKILL.md:145-153 SKILL.md:153-202 SKILL.md:202-210 SKILL.md:210-224 SKILL.md:224-228 SKILL.md:228-237 SKILL.md:237-241 SKILL.md:241-246 SKILL.md:246-256 SKILL.md:256-273 SKILL.md:273 SKILL.md:274 SKILL.md:275 SKILL.md:276 SKILL.md:282 SKILL.md:284 SKILL.md:292 SKILL.md:298-303 SKILL.md:303 SKILL.md:309-315 SKILL.md:315 SKILL.md:320-326 SKILL.md:326-330 SKILL.md:330 SKILL.md:334 SKILL.md:338 SKILL.md:342 SKILL.md:343-345 SKILL.md:345 SKILL.md:127 SKILL.md:179 SKILL.md:183 SKILL.md:111-129 SKILL.md:153-202
🌐 Network access (6)
📁 Filesystem access (14)
🔑 Env variables (2)
Audited by: codex
Jun 30, 2026, 10:45 AM
Static findings are mostly expected for a documentation skill that provides shell commands for RunComfy, ImageMagick, and Codex pet installation. No malicious prompt injection or credential exfiltration was found, but the recipes use network calls, local file writes, and an unsanitized pet name in paths.
1
Files scanned
348
Lines analyzed
8
Review items
1
False positives ignored
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Unsanitized Pet Name Used In File Paths
PET_NAME is used directly to construct RUN_DIR and DEST. A value containing path traversal can write generated files outside the intended pet folders.
The variable is quoted, which reduces shell injection risk, but it is not validated before path construction. The write operations are explicit and target user-controlled paths.
Medium
Third-Party Network Processing Of User Image URLs
The workflow sends a user-provided source image URL to the RunComfy GPT Image endpoint. This is expected behavior, but users should understand the privacy boundary.
The RunComfy CLI call is central to the skill and the security notes disclose the outbound endpoints. The risk is disclosure of submitted image URLs and image content to a third party.
Medium
External CLI Recipes Require Local Execution
The skill instructs agents to install and run npm, runcomfy, and magick commands. These commands are legitimate for the workflow but expand the local execution surface.
The commands are documented recipes rather than hidden code. They still require trusted tools and should be reviewed before execution in sensitive environments.
Low
Credential Access Is Disclosed And Limited To RunComfy Token Use
The skill references RUNCOMFY_TOKEN and RunComfy token storage. This is required for authentication and no unrelated secret harvesting was found.
The token references are specific to RunComfy authentication and the document states local token storage details. I found no evidence of sending unrelated environment secrets.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Weak Cryptography Findings Are False Positives
The static cryptography alerts appear to match dimensions, colors, hashes, or animation values in documentation, not cryptographic implementation.
SKILL.md contains no implemented cryptographic algorithm. The flagged lines describe image generation, metadata, colors, or file content examples.
Risk Factors
⚙️ External commands (8)
🌐 Network access (8)
📁 Filesystem access (13)
🔑 Env variables (4)
Detected Patterns
Network Command To RunComfy Model APIHome Directory Pet InstallationShell Command Substitution In Recipe
Audited by: codex
May 28, 2026, 09:27 AM
This is a legitimate Codex Pet generator that uses RunComfy CLI and ImageMagick to create animated pet spritesheets. The static analysis flagged many patterns (97 command usages, filesystem access) but these are all legitimate tool invocations. The external commands (`runcomfy run`, `magick`) use hardcoded arguments derived from skill logic, not user-controlled shell input. Network calls go only to runcomfy.net endpoints. Path traversal in PET_NAME is a low concern as writes are scoped to the ~/.codex/pets sandbox. Environment variable access is explicit and documented (RUNCOMFY_TOKEN). No credential exfiltration, no data theft patterns, no command injection vectors confirmed. Skill performs exactly what it claims: generates pet spritesheets via API + ImageMagick transforms.
1
Files scanned
348
Lines analyzed
7
Review items
0
False positives ignored
Confirmed security concerns (1)
Low
External URL fetch in Image Processing Pipeline
The skill accepts a SOURCE_URL parameter and fetches external images. This is standard for image generation workflows but introduces a data boundary concern: external images are processed by RunComfy's servers. Documented as a known risk.
Image URL processing is a legitimate workflow requirement. Risk is properly documented in Security & Privacy section at line 344.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Path Injection via PET_NAME in mkdir/cp Commands
PET_NAME user input is interpolated into mkdir and cp paths without sanitization. A malicious PET_NAME like '../../etc' could escape the intended ~/.codex/pets/ directory. This is a LOW-to-MEDIUM risk because: (1) writes are scoped to local filesystem only, (2) no privilege escalation apparent, (3) Codex pet directories are user-controlled workspace. However, the shell commands at lines 242-245 concatenate PET_NAME directly into mkdir/cp with no validation.
Pattern confirmed: PET_NAME from user input concatenated into mkdir -p DEST path at line 242. However, scope is sandboxed to ~/.codex/pets/ which limits blast radius. Low practical exploitability for remote scenarios.
Low
Hidden File in Home Directory Access
Skill accesses ~/.config/runcomfy/token.json to store API credentials. This is standard configuration file access for authenticated CLI tools, documented openly in the Security & Privacy section. Not a security vulnerability but worth noting for transparency.
Standard credential storage pattern for CLI tools. Token file with mode 0600 is appropriate security practice.
Risk Factors
⚙️ External commands (6)
🌐 Network access (2)
📁 Filesystem access (2)
🔑 Env variables (2)
Audited by: claude