Versioned security assessment
Report ID: SA-5AEC4028
7/5/2026, 9:22:19 PM
codex-pet security assessment v3
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- codex-pet
- Version
- v3
- Maintainer
- runcomfy-com
- Coverage
- 1 Files scanned · 348 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Medium
2 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Most static detections are Markdown false positives, but the workflow still performs real external CLI, network, credential, and hidden filesystem operations. Confirmed risks include global package installation, RunComfy token use, image processing through third-party services, and writes into Codex configuration paths. I found no prompt injection attempt in the skill text.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
1 Files scanned · 348 Lines analyzed
31 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 6 evidence locations
Filesystem access
May read or write local files.
Observed in 13 evidence locations
Env variables
May read values from the process environment.
Observed in 2 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 54 evidence locations
Capability review items (29)
High
Hidden file in home directory
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The skill documents token storage in ~/.config/runcomfy/token.json. Persisted API credentials in hidden files are sensitive even with restrictive permissions.
High
Generic API/secret keys
OPENAI_API_KEY required, only RUNCOMFY_TOKEN. Triggers on "codex pet",
The description says RUNCOMFY_TOKEN is required. No secret value is embedded, but the workflow depends on a live API credential.
High
Generic API/secret keys
**This Codex Pet skill is a drop-in alternative that runs via the RunComfy CLI**: a single `RUNCOMFY
The skill requires RUNCOMFY_TOKEN for the RunComfy CLI. Using a community workflow with an API token is a real credential-handling risk.
Medium
Ruby/shell backtick execution
`runcomfy run openai/gpt-image-2/edit` to produce a canonical Codex
The skill advertises running the RunComfy CLI for image generation. This is expected functionality, but it crosses an external command and network boundary.
Medium
Ruby/shell backtick execution
```bash
The snippet instructs a global skill install through npx, which executes package manager code from an external source. Community package installation should require explicit user confirmation.
Medium
Ruby/shell backtick execution
**This Codex Pet skill is a drop-in alternative that runs via the RunComfy CLI**: a single `RUNCOMFY
The text requires the runcomfy and magick binaries plus a RunComfy token. Running credentialed third-party CLIs is a real security boundary.
Medium
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
The prerequisite tells users to install the RunComfy CLI globally with npm. Global package installation can modify the host environment and carries supply-chain risk.
Medium
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login`. CI alternative: `RUNCOMFY_TOKEN=<token>`.
The prerequisite instructs running runcomfy login or using RUNCOMFY_TOKEN. That invokes a local CLI with API credentials.
Medium
Ruby/shell backtick execution
3. **ImageMagick** — `brew install imagemagick` (macOS) or `apt-get install imagemagick` (Linux). Pr
The line instructs installing ImageMagick through system package managers. These commands alter the host environment and should require user confirmation.
Medium
Ruby/shell backtick execution
1. **Canonical Codex Pet** — single `runcomfy run openai/gpt-image-2/edit` call producing one 1024x1
The pipeline calls runcomfy run against a remote image generation model. This is intentional, but it is still external command execution with network effects.
Medium
Ruby/shell backtick execution
6. **Manifest + install** — write `pet.json`, copy both files into `${CODEX_HOME:-$HOME/.codex}/pets
The pipeline step describes writing a manifest and copying files into the Codex pet directory. It is expected, but it mutates the local filesystem.
Medium
Ruby/shell backtick execution
```bash
The bash block runs runcomfy with user-provided image input and writes output files. This is a real command execution path with network and filesystem effects.
Medium
Ruby/shell backtick execution
```bash
The bash block runs ImageMagick on generated image files and writes a normalized cell. Image processing through an external binary is intentional but real command execution.
Medium
Ruby/shell backtick execution
```bash
The bash block defines helpers that run magick and cp while creating animation frames. These commands process files and write many artifacts locally.
Medium
Ruby/shell backtick execution
```bash
The bash block runs ImageMagick to compose and convert the final atlas. This is expected, but it executes external binaries on generated files.
Medium
Ruby/shell backtick execution
```bash
The bash block writes pet.json through a shell heredoc. It is part of the intended workflow, but it creates local files from shell variables.
Medium
Ruby/shell backtick execution
```bash
The install block runs mkdir and cp into the Codex pets directory. This mutates hidden local configuration and should validate the destination path.
Medium
Ruby/shell backtick execution
1. The skill calls `runcomfy run openai/gpt-image-2/edit` once with the user's source image and a ti
The workflow summary states the skill calls runcomfy with the source image. This confirms external command execution and third-party image processing.
Medium
Ruby/shell backtick execution
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The security section documents runcomfy login storing an API token locally. Credentialed CLI execution and token persistence are real security concerns.
Medium
Hidden file access
into `${CODEX_HOME:-$HOME/.codex}/pets/<name>/` and Codex picks it up
The description tells users to place generated artifacts under ${CODEX_HOME:-$HOME/.codex}/pets. This is intended, but it writes into hidden Codex configuration.
Medium
Hidden file access
**Codex Pet generator on RunComfy.** Turn one source image into a Codex-compatible custom Codex Pet
The introduction repeats the hidden Codex pets path as the install target. It is expected functionality, but it mutates a hidden application directory.
Medium
Hidden file access
OpenAI Codex Pets (released May 2026) are pixel-art animated companions that float over your desktop
The line documents custom Codex Pets as folders under ${CODEX_HOME:-$HOME/.codex}/pets. This confirms hidden directory use, though it is descriptive.
Medium
Hidden file access
6. **Manifest + install** — write `pet.json`, copy both files into `${CODEX_HOME:-$HOME/.codex}/pets
The pipeline explicitly says the manifest and sprite sheet are copied into ${CODEX_HOME:-$HOME/.codex}/pets. That is a hidden local configuration write.
Medium
Hidden file access
DEST="${CODEX_HOME:-$HOME/.codex}/pets/${PET_NAME}"
The install command builds DEST under ${CODEX_HOME:-$HOME/.codex}/pets/${PET_NAME}. This hidden-path write should validate PET_NAME and the resolved destination.
Medium
Hidden file access
**What is a Codex Pet?** OpenAI Codex Pets are pixel-art animated companions launched May 2026 that
The FAQ states custom pets live under ${CODEX_HOME:-$HOME/.codex}/pets/<name>. It is expected, but confirms reliance on hidden Codex configuration.
Medium
Hidden file access
**How do I install my Codex Pet?** Copy `pet.json` and `spritesheet.webp` into `${CODEX_HOME:-$HOME/
The FAQ instructs copying pet files into ${CODEX_HOME:-$HOME/.codex}/pets/<pet-name>. That is a hidden directory write and should require user consent.
Medium
Hidden file access
5. A `pet.json` manifest is written; both files are copied into `${CODEX_HOME:-$HOME/.codex}/pets/<n
The workflow summary says both files are copied into ${CODEX_HOME:-$HOME/.codex}/pets/<name>. This confirms local hidden configuration mutation.
Medium
Hidden file access
- **Local install path**: the final Codex Pet writes to `${CODEX_HOME:-$HOME/.codex}/pets/<pet-name>
The security section states the final pet writes to ${CODEX_HOME:-$HOME/.codex}/pets/<pet-name>. This is intended but still a hidden application directory write.
Low
Hardcoded URL
SOURCE_URL="https://.../source.png"
SOURCE_URL is a placeholder for a publicly fetchable image passed to RunComfy. The placeholder is not malicious, but the workflow depends on external network retrieval.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (2)
RISK-001 Medium
Unsanitized Pet Name Used in Filesystem Paths
PET_NAME is interpolated into RUN_DIR and DEST without validation. A name containing path traversal text could write generated files outside the intended pet folder.
The shell snippets use PET_NAME directly in directory paths and copy commands. The example value is safe, but the skill gives no validation rule for user-supplied names.
RISK-002 Medium
Third-Party Image Processing Boundary
The workflow sends a user-provided source image URL to RunComfy for remote GPT Image 2 processing. Confidential images or image-based prompt injection can cross this boundary.
The runcomfy command passes SOURCE_URL as image input, and the security section states external URLs are fetched by RunComfy. This is intentional but security-relevant.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighThe workflow depends on RUNCOMFY_TOKEN and local token storage.Document token scope, revocation, and log hygiene. Prefer environment variables for CI and avoid printing token-bearing commands.
- FIX-002MediumPet names are used directly in filesystem paths.Validate pet names with a strict slug rule and reject slashes, dots, empty names, and path traversal text before creating paths.
- FIX-003MediumThe skill instructs global package installation and external CLI execution.Require explicit user confirmation, pin trusted package versions where possible, and show commands before execution.
- FIX-004MediumSource image URLs are sent to a third-party service.Warn users not to provide confidential images and request consent before sending any URL to RunComfy.
- FIX-005MediumGenerated files are written into hidden Codex configuration paths.Resolve the destination path, confirm it remains under CODEX_HOME/pets, and ask before overwriting existing pet files.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable