ambientcg-assets
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill connects to ambientCG's official API to fetch asset metadata and download archive files. All network operations are scoped to the domain 'ambientcg.com', which is a well-known repository for CC0 3D assets.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the ambientCG API. Ingestion points: 'scripts/_ambientcg.py' via the 'json_api' function. Boundary markers: Not explicitly defined in the API response processing. Capability inventory: Writing downloaded archives to the local file system in 'scripts/_ambientcg.py'. Sanitization: Downloaded filenames are extracted using 'Path.name' to prevent directory traversal attacks. The risk is low as the data is used for display and file naming rather than autonomous decision-making.
Audit Metadata