mesh-qa
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external assets such as 3D models (GLB files) and media references which could contain adversarial content or metadata designed to influence agent behavior.
- Ingestion points: Processes
raw.glbfiles viamesh_symmetrize.pyand retrieves media from external sources including the Wikimedia API, Google Images, and YouTube clips. - Boundary markers: The skill lacks explicit instructions or boundary markers to differentiate between system instructions and data embedded within processed files.
- Capability inventory: The agent executes generated Python scripts in a Blender environment, performs network requests to external domains, and manages files in local working directories.
- Sanitization: There are no described procedures for sanitizing or validating metadata or data structures within ingested 3D assets or media downloads.
- [DYNAMIC_EXECUTION]: The instructions require the agent to generate and subsequently execute several local Python scripts to perform its core analysis functions. This involves generating logic based on requirements tables and executing it in a sub-process (background Blender), representing a dynamic code generation and execution surface.
- [COMMAND_EXECUTION]: The workflow relies on the execution of multiple Python and PowerShell scripts to automate geometry analysis and rendering, providing a persistent capability for local script and command invocation.
Audit Metadata