touchdesigner-mcp

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/setup.sh script is configured to download an external TouchDesigner component (twozero.tox) from https://www.404zero.com/pisang/twozero.tox using curl.
  • [COMMAND_EXECUTION]: The skill defines several tools that allow for command execution:
  • td_execute_python enables the agent to run arbitrary Python code within the TouchDesigner environment, which has full access to the local filesystem and the TouchDesigner API.
  • td_input_execute allows the agent to send mouse and keyboard commands (clicks, typing, focus) to the TouchDesigner application.
  • [REMOTE_CODE_EXECUTION]: The SKILL.md instructions guide the user to execute a local setup script (scripts/setup.sh) which performs network operations and modifies configuration files.
  • [DYNAMIC_EXECUTION]: The skill facilitates the dynamic generation and execution of code at runtime:
  • td_write_dat and td_execute_python are used to inject and run Python scripts and GLSL shaders into TouchDesigner operators.
  • The documentation in references/glsl.md and references/network-patterns.md provides templates for dynamic shader compilation and execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it is designed to ingest and process data from various external sources.
  • Ingestion points: Untrusted data enters the context through tools like td_read_dat, td_read_chop, and networking operators described in references/external-data.md (WebSockets, MQTT, HTTP, and Serial).
  • Boundary markers: The instructions do not specify explicit delimiters or "ignore embedded instructions" warnings for data read from external sources.
  • Capability inventory: The skill has extensive capabilities including arbitrary Python execution (td_execute_python), UI automation (td_input_execute), and filesystem interaction within the host environment.
  • Sanitization: While references/external-data.md mentions basic validation for sensor data, there is no comprehensive sanitization logic described for handling potential instructions embedded in external network data.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 07:35 PM
Security Audit — agent-trust-hub — touchdesigner-mcp