Versioned security assessment

Report ID: SA-0519034D

7/9/2026, 12:03:38 PM

codex-pet security assessment v5

Skill Security Certification Report

Audit History

Audit model: codex Historical report

Skill name: codex-pet
Version: v5
Maintainer: runcomfy-com
Source: github.com/runcomfy-com/skills/tree/main/codex-pet/
Coverage: 1 Files scanned · 348 Lines analyzed
Policy version: Unavailable

Highest confirmed finding severity

Medium

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static alerts are Markdown formatting false positives, not executable Ruby backticks or hidden behavior. The skill intentionally asks users to run RunComfy and ImageMagick commands, sends a source image URL to a third-party service, and writes assets into the Codex pets directory. The main actionable issue is unvalidated PET_NAME usage in local paths.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 348 Lines analyzed

16 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 6 evidence locations

Filesystem access

May read or write local files.

Observed in 13 evidence locations

Env variables

May read values from the process environment.

Observed in 2 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 50 evidence locations

Capability review items (14)

Medium

SKILL.md:30-32

Ruby/shell backtick execution

```bash

The fenced shell block instructs a global skill install through npx from a community repository. It is user-visible, but it can modify the local Codex skills environment and should require confirmation.

Medium

SKILL.md:93-94

Ruby/shell backtick execution

1. **RunComfy CLI** — `npm i -g @runcomfy/cli`

This prerequisite asks the user to install a global CLI package. Package installation is expected, but it executes third-party installer code on the host.

Medium

SKILL.md:94

Ruby/shell backtick execution

2. **RunComfy account** — `runcomfy login`. CI alternative: `RUNCOMFY_TOKEN=<token>`.

This prerequisite invokes runcomfy login or a token environment variable. It is documented, but it handles credentials and should not be automated without user consent.

Medium

SKILL.md:95

Ruby/shell backtick execution

3. **ImageMagick** — `brew install imagemagick` (macOS) or `apt-get install imagemagick` (Linux). Pr

This prerequisite asks the user to install ImageMagick through system package managers. It is expected setup, but it changes system packages and should be user-approved.

Medium

SKILL.md:100-105

Ruby/shell backtick execution

1. **Canonical Codex Pet** — single `runcomfy run openai/gpt-image-2/edit` call producing one 1024x1

This describes a RunComfy CLI call that sends a source image request to a remote model endpoint. It is core functionality, but it is a real external command and network action.

Medium

SKILL.md:111-129

Ruby/shell backtick execution

```bash

The fenced shell recipe executes runcomfy with user-supplied SOURCE_URL and writes output to RUN_DIR. The action is explicit, but it performs remote processing and local file writes.

Medium

SKILL.md:135-145

Ruby/shell backtick execution

```bash

The fenced shell recipe runs ImageMagick on generated image files. It is local intended processing, but it executes an external binary against image input.

Medium

SKILL.md:153-202

Ruby/shell backtick execution

```bash

The fenced shell recipe defines ImageMagick helper functions and copies generated frames. It is intended local processing, but it executes external commands across user-named paths.

Medium

SKILL.md:210-224

Ruby/shell backtick execution

```bash

The fenced shell recipe composes the sprite atlas with ImageMagick and writes output files. This is expected, but it executes an external binary on generated assets.

Medium

SKILL.md:228-237

Ruby/shell backtick execution

```bash

The fenced shell recipe writes pet.json using shell-expanded variables. It is intended output generation, but unescaped values can create malformed local configuration.

Medium

SKILL.md:241-246

Ruby/shell backtick execution

```bash

The fenced shell recipe creates DEST and copies generated files into the Codex pets directory. This is expected behavior, but it modifies hidden application state in the user's home directory.

Medium

SKILL.md:111-129

Template literal with command substitution

```bash

The shell recipe interpolates SOURCE_URL, RUN_DIR, and CHROMA into the RunComfy CLI payload. It is visible and intended, but unsafe values can affect remote processing inputs and output paths.

Medium

SKILL.md:153-202

Template literal with command substitution

```bash

The shell recipe interpolates variables into ImageMagick and copy operations. It is intended automation, but the paths depend on user-selected names and should be constrained.

Medium

SKILL.md:242

Hidden file access

DEST="${CODEX_HOME:-$HOME/.codex}/pets/${PET_NAME}"

DEST points under ${CODEX_HOME:-$HOME/.codex} and includes PET_NAME before mkdir and cp. This is an intended install path, but without pet-name validation it can write outside the expected pets directory.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Medium

SKILL.md:119-125 SKILL.md:344-345

Third-Party Image Processing Requires Consent

The RunComfy command sends the source image URL and prompt to a remote model service. Private images or signed URLs could leave the local trust boundary.

The command includes SOURCE_URL in the RunComfy request, and the security notes state that the RunComfy server fetches third-party content. The behavior is disclosed, but it is still a privacy boundary.

RISK-002 Medium

SKILL.md:112-115 SKILL.md:242-244

Unvalidated Pet Name Controls Install Path

PET_NAME is inserted into RUN_DIR and DEST without validation. A name containing path separators can move writes outside the intended pet folder.

The shell recipe builds directories directly from PET_NAME and then runs mkdir and cp. The default value is safe, but the instructions do not constrain user-supplied names.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

FIX-001
Medium
Pet names are used directly in run and install paths.

Accept only simple pet names such as lowercase letters, numbers, hyphens, and underscores. Reject slashes, dot segments, and shell metacharacters.
FIX-002
Medium
Source image URLs are processed by a third-party service.

Ask for explicit user consent before remote generation. Warn users not to provide private images, signed URLs, or confidential project assets.
FIX-003
Low
pet.json is written with shell-expanded values.

Generate the manifest with a JSON writer or escaping step so quotes and newlines cannot corrupt the file.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable