The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/usd.py wraps several local command-line utilities from the OpenUSD toolset (e.g., usdcat, usdchecker, usdrecord). It uses subprocess.call() with a list of arguments, which is a secure method to prevent shell injection vulnerabilities.
[DATA_EXPOSURE]: The skill operates on local USD files provided by the user. Analysis confirmed that it does not access sensitive system paths, environment variables, or hardcoded credentials.
[INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes external USD files that could contain malicious instructions in metadata or documentation fields. However, the skill acts primarily as a pass-through for specialized binary tools, and there is no evidence of the agent interpreting file content as executable instructions.
Ingestion points: User-supplied file paths processed via usd.py in scripts/usd.py.
Boundary markers: Not present in the script's command construction.
Capability inventory: Uses subprocess.call() to execute specific USD-related binaries in scripts/usd.py.
Sanitization: Arguments are managed as a list in subprocess.call(), mitigating shell injection, though file content itself is not sanitized by the wrapper.

vfx-usd