image-to-3d
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
luxin-clipackage from the npm registry usingnpxand fetches skill definitions from the author's GitHub repository (danielgwilson/luxin). These resources are provided by the skill author. - [COMMAND_EXECUTION]: The skill uses
npxto execute commands for asset creation and skill management. It also modifies environment variables likeHOMEandCODEX_HOMEto redirect local storage to a workspace-specific directory. - [INDIRECT_PROMPT_INJECTION]: The skill processes image inputs which could potentially contain adversarial content intended to influence agent behavior. Ingestion points: External image data provided via the
--inputargument. Boundary markers: None identified in the provided instructions. Capability inventory: Subprocess execution vianpxto run the Luxin CLI. Sanitization: No explicit sanitization or validation of image content is mentioned in the skill instructions.
Audit Metadata