Codex Pet Generator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:21 AM UTC
• Version: 1.1.0

Overview

This skill openly builds and installs local Codex pet assets, with no evidence of hidden exfiltration, credential use, or persistence beyond the generated files.

Install this only if you want an agent to generate images, create local run artifacts, optionally search the web for brand cues, and place the finished custom pet under your Codex pets directory. Use a unique pet id to avoid overwriting an existing custom pet, and provide your own mascot cues instead of a confidential brand name if web discovery is not desired.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The declared description presents a broad end-to-end pet-generation and packaging skill: prompt/image-driven creation, repair, upgrade, validation, packaging, and installation of a complete Codex-compatible v2 pet package. The supplied code chunk is much narrower. It is a command-line image-processing utility focused on assembling an extended atlas from existing image assets. It loads a base atlas, extracts or loads 16 look-direction cells, chroma-keys backgrounds, normalizes geometry against a neutral reference, validates edge clipping, pastes the look frames into rows 9 and 10, and optionally writes a simple manifest. This supports part of a pet asset pipeline, but it does not transform arbitrary keywords into a full pet, does not synthesize all standard animation rows, and does not install/package a complete pet in the expansive sense claimed. Therefore the description materially overstates and mischaracterizes the actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises an end-to-end Codex pet creation and packaging system, including generation, repair, validation, and installable package output. The supplied code does none of that. Instead, it is a narrow evaluation/QA helper that merges multiple independent verdict JSON files by majority vote for pairwise directional judgments. This is a materially different primary purpose, with different inputs (verdict JSON files instead of keywords/images) and outputs (combined review JSON instead of pet packages). Therefore the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description describes an end-to-end Codex pet package generator and installer. The supplied code only assembles a spritesheet atlas image from source images. It validates dimensions/aspect ratio, locates row frames, centers/resizes frames into fixed cells, clears RGB under transparent pixels, and writes image outputs. While this supports part of a pet asset pipeline and does reflect the '9 standard animation rows' aspect, it does not implement the broader claimed functionality such as keyword-driven generation, package assembly, compatibility metadata, QA, installation, or full pet creation workflow. Therefore the description materially overstates the code's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises an end-to-end Codex pet generation and packaging system with broad creation, validation, upgrade, and installation functionality. The supplied code chunk instead performs a narrow image-processing task: it reads four preexisting PNGs for cardinal directions, checks dimensions/content, and combines them into a strip. This is materially different from the declared primary purpose and lacks nearly all claimed capabilities. There is no evidence of pet-package generation, animation-row synthesis, 16-direction output, metadata packaging, installation, or keyword/reference-image driven creation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description claims a broad end-to-end pet creation and lifecycle capability: generating complete installable Codex pet packages from keywords or images, repairing/upgrading/validating them, producing all standard animation rows and directions, and packaging/installing them. The actual code chunk performs a much narrower, specific task: it checks a manifest in a provided run directory, verifies that a running-right job is complete and that mirroring is allowed, mirrors the running-right sprite strip frame-by-frame to create running-left, saves the derived image, and updates manifest metadata. This is at best a small supporting step within a larger pipeline, not the claimed primary functionality. Therefore the description materially overstates what this code does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a full pet-package creation and lifecycle tool for Codex pets. The supplied code chunk is only a utility for chroma spill suppression on image edges using Pillow. It parses an input image, chroma key color, and tuning parameters; processes pixel colors near alpha boundaries; writes cleaned image files and optional JSON metrics. There is no evidence of pet generation, sprite sheet assembly, animation row enforcement, direction handling, QA orchestration, package manifest creation, installation, or Codex v2 packaging. This is a materially different and much narrower purpose than declared, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises an end-to-end Codex pet creation and packaging system with broad functionality: creating pets from keywords or images, validating them, upgrading/repairing them, and producing complete installable v2 packages with all standard animation content. The actual code chunk is much more limited and different in primary purpose. It only processes a provided image strip into four directional anchor images, applies chroma-key transparency removal, checks simple QA thresholds, and emits a JSON summary. There is no evidence of keyword-to-pet generation, reference-image interpretation beyond basic image input, no assembly of a full multi-row/multi-direction pet sheet, and no package/install logic. This is a material description-behavior mismatch, not merely an implementation detail.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a full end-to-end Codex pet creation and packaging skill. The supplied code chunk is a narrow utility for post-processing sprite strips into per-frame PNGs. It reads PNG strip files from a decoded directory, optionally reads a chroma key from pet_request.json, removes green-screen-like backgrounds, extracts frames by connected components or equal slots, and writes frames-manifest.json. It does not create pets from keywords/images, build installable packages, perform installation, enforce full v2 packaging requirements, or provide the broad repair/upgrade/validation workflow claimed. This is a material purpose mismatch, not just an implementation detail.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a full pet-generation and packaging skill with one-click creation, repair, upgrade, validation, packaging, and installation of Codex-compatible v2 pets. The supplied code chunk does not implement that broad functionality. It is narrowly focused on inspecting extracted frame files under expected animation state folders, validating counts/sizes/pixel characteristics, reading a manifest for extraction method and chroma key, and emitting a JSON report. Validation is a supporting detail mentioned in the description, but the code’s primary purpose is only that subtask, not end-to-end pet creation or packaging. Therefore the description materially overstates the behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear mismatch between the declared description and the actual code. The description promises an end-to-end Codex pet creation and packaging workflow, including generation from prompts or images, QA, repair/upgrade, and installable v2 packaging. The code provided only opens an existing atlas PNG, checks that it matches expected atlas dimensions, and renders a labeled contact sheet for review. This is a narrow debugging/inspection utility, not a pet generator, packager, installer, or comprehensive validator. The minor dimension check is only incidental validation and does not substantively match the broad declared functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises an end-to-end system for creating, validating, packaging, repairing, upgrading, and installing Codex pet packages from broad user inputs. In contrast, this code chunk performs a very specific deterministic QA-related task: it validates an existing extended atlas size, crops look-direction cells from a fixed row layout, shuffles predefined axis pairs, creates a two-column comparison sheet, and emits an answer key JSON. This is at most a supporting component for direction-blind QA, not a full pet-package generator or installer. The behavior is materially narrower and different from the declared primary purpose, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises an end-to-end pet creation and packaging system with broad capabilities: generating pets from keywords/reference images, repairing/upgrading/validating them, ensuring 9 animation rows and 16 directions, and packaging/installing Codex v2 pets. The actual code does none of that. It is a single image-processing helper that expects an existing 1536x2288 atlas, crops predefined cells, labels them with direction names, creates focused zoom views, and writes out a QA sheet. While this may support a larger pet workflow, this code chunk’s actual purpose is limited to visualization/QA of look-direction frames, which is materially narrower and different from the declared primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad pet-creation and packaging tool with end-to-end functionality: creating installable Codex pet packages from keywords or images, validating them, and packaging/installing them. The actual code chunk only measures continuity across 16 look-direction sprites in a preexisting atlas and emits a JSON report with warnings. While validation/QA is mentioned in the description, this code is only a small specialized validator component and does not implement the primary declared purpose of complete pet generation, repair, upgrade, packaging, or installation. Therefore the code chunk's behavior is materially narrower and different from the declared overall skill behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code is clearly focused on scaffolding a workflow rather than completing it. It creates folders, copies reference inputs, computes metadata such as chroma key selection, draws layout guides, writes prompt files for animation/image generation, and creates an imagegen-jobs.json manifest describing downstream jobs. While this supports the declared workflow and encodes the intended 9 standard rows, look directions, and sprite_version_number=2 metadata, it stops short of the declared end-to-end outcome. There is no code here that generates final sprite sheets, validates outputs deterministically, assembles/package files into an installable Codex pet, repairs/upgrades an existing package, or installs anything. So the description overstates what this code chunk itself does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a full pet-generation and packaging skill, but the supplied code is a narrow utility for QA preview rendering. It expects pre-existing extracted frames in specific state folders, verifies frame counts, writes GIF animations, and prints a JSON report. There is no logic for keyword/image-driven pet creation, sprite sheet assembly, package generation, installation, upgrade/repair, or Codex metadata/version packaging. While preview generation could be a supporting component of a larger pet toolchain, this code chunk by itself does not match the broad declared primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description presents a broad end-to-end pet creation and packaging skill, but the code chunk only implements validation of an existing spritesheet atlas. Its primary purpose is quality checking image structure and transparency/chroma characteristics for a Codex pet atlas. While validation is one capability mentioned in the description, the claimed core behavior—turning a keyword into a complete installable pet package—is not represented in this code. Therefore the code materially underdelivers relative to the declared purpose, making the description inaccurate for this supplied chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear material mismatch. The declared description presents a full pet-generation and packaging skill, but the supplied code only validates blind direction verdicts against an answer key. Its inputs are JSON files containing pairwise classifications, and its outputs are a validation report and process exit status. It does not perform pet creation, repair, upgrade, packaging, installation, image handling, or complete deterministic QA for pet assets. While validation is mentioned in the description, this script covers only a small, specific direction-checking task rather than the claimed end-to-end Codex pet package functionality.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill explicitly instructs extensive file reads and writes, including copying artifacts into ${CODEX_HOME}/pets, deleting generated files, and updating manifests, but it declares no tool scope or allowed-tools boundary. That creates unnecessary ambient authority: if the skill is invoked, the agent may perform filesystem operations beyond what a minimally scoped pet-generation workflow should require.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation criteria are broad enough to trigger on generic mentions of 'Codex pet' or related phrases, while the skill can write files, install artifacts, and perform networked brand discovery. Over-broad activation increases the chance of accidental execution of a side-effectful workflow when the user intended only discussion, brainstorming, or review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill promises to deliver an installed pet folder and later copies files into ${CODEX_HOME}/pets/<pet-id> without a prominent upfront warning or confirmation. Silent installation into an application-owned directory is a meaningful integrity risk because it modifies the user's environment and could overwrite or clutter local assets if names or paths are mishandled.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs a subagent to perform external web research on brands and companies, expanding its behavior beyond pure local pet generation into network-enabled data collection. In a security-sensitive environment, this broadens attack surface and can leak user intent or proprietary target names to external services without an explicit, narrowly scoped consent step.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · scripts/prepare_pet_run.py (reported line 592)May include surrounding context.

python

def look_row_layout_contract() -> str:
    return """HARD LAYOUT AND CONTINUITY CONTRACT — DETERMINISTIC REGISTRATION: draw exactly eight separated pose groups in left-to-right direction order. Keep enough chroma-only space between neighboring poses that each complete pose can be detected without cutting through foreground. Approximate the guide's equal spacing, but do not distort a pose merely to hit an exact source-canvas coordinate; deterministic assembly will crop the eight ordered groups, then apply one shared scale and baseline.

Use the same body height, head size, baseline, and planted-body position across the generated family. Never overlap neighboring poses, merge two poses into one connected group, crop foreground at the outer canvas edge, or resize one pose independently.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The short description is written in Chinese while the default prompt is written in English, which imposes language expectations without any documented user opt-in or language selection. This can violate language/locale policy expectations because the skill does not state that it is Chinese-only or let users choose their preferred language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This script creates output directories and writes extracted PNG frames to disk, but the write operations themselves are not accompanied by any user-facing warning or confirmation near the action. Although the module docstring suggests extraction behavior, there is no explicit disclosure that existing output paths may be populated or overwritten with generated frame files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The script writes a frames-manifest.json file containing processing metadata into the output directory, but there is no explicit warning in help text or comments that this additional file will be created. Users may not expect both image outputs and a JSON manifest to be persisted.

Content

No source excerpt is available for this finding.