dcc-mcp-creator
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates as a development tool that ingests project files, Digital Content Creation (DCC) scene data, and environment configurations to scaffold adapters. This creates an attack surface where untrusted data (like external project files or scene assets) could influence agent behavior.
- Ingestion points: Project files, environment variables (
DCC_MCP_*), and DCC API outputs (scene statistics, document content). - Boundary markers: Instructions explicitly require the use of core helpers that perform payload-safe state reporting and provide a "conservative redaction status."
- Capability inventory: The skill uses
Bash,Read,Write, andEdittools. It instructs the agent to manage subprocesses via Python and Rust for service lifecycle management. - Sanitization: The skill mandates the use of
DccServerBaseandHostExecutionBridge, which implement structured result envelopes, deterministic fingerprints for scene data, and automatic redaction of sensitive payloads. - [DYNAMIC_EXECUTION]: The skill provides detailed implementation guidance for adapters that expose Python script execution (
execute_python) within DCC hosts like Maya, Blender, and Nuke. - Evidence: Guidelines in
references/RUNTIME_INTEGRATION.mddescribe usingScriptExecutionContextto isolate script execution andregister_state_digest_providerto pin scene observations. It warns developers not to expose raw script execution as the primary workflow. - [EXTERNAL_DOWNLOADS]: The skill references standard package managers and specific trusted repositories for dependency management and testing.
- Evidence: Mentions
pip,npm, andcargofor installing dependencies. It provides links to thedcc-mcporganization's GitHub repositories and the Model Context Protocol (MCP) Inspector for debugging. - [COMMAND_EXECUTION]: The skill utilizes shell commands for environment validation, service management, and automated testing.
- Evidence: Instructions include using
dcc-mcp-clifor linting, health checks, and lifecycle management (plan, execute, verify, status, uninstall). It also recommends usingvx uvorcargofor project builds.
Audit Metadata