dcc-mcp-creator

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill operates as a development tool that ingests project files, Digital Content Creation (DCC) scene data, and environment configurations to scaffold adapters. This creates an attack surface where untrusted data (like external project files or scene assets) could influence agent behavior.
  • Ingestion points: Project files, environment variables (DCC_MCP_*), and DCC API outputs (scene statistics, document content).
  • Boundary markers: Instructions explicitly require the use of core helpers that perform payload-safe state reporting and provide a "conservative redaction status."
  • Capability inventory: The skill uses Bash, Read, Write, and Edit tools. It instructs the agent to manage subprocesses via Python and Rust for service lifecycle management.
  • Sanitization: The skill mandates the use of DccServerBase and HostExecutionBridge, which implement structured result envelopes, deterministic fingerprints for scene data, and automatic redaction of sensitive payloads.
  • [DYNAMIC_EXECUTION]: The skill provides detailed implementation guidance for adapters that expose Python script execution (execute_python) within DCC hosts like Maya, Blender, and Nuke.
  • Evidence: Guidelines in references/RUNTIME_INTEGRATION.md describe using ScriptExecutionContext to isolate script execution and register_state_digest_provider to pin scene observations. It warns developers not to expose raw script execution as the primary workflow.
  • [EXTERNAL_DOWNLOADS]: The skill references standard package managers and specific trusted repositories for dependency management and testing.
  • Evidence: Mentions pip, npm, and cargo for installing dependencies. It provides links to the dcc-mcp organization's GitHub repositories and the Model Context Protocol (MCP) Inspector for debugging.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands for environment validation, service management, and automated testing.
  • Evidence: Instructions include using dcc-mcp-cli for linting, health checks, and lifecycle management (plan, execute, verify, status, uninstall). It also recommends using vx uv or cargo for project builds.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 10:33 PM