material-maker-materials
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external PTEX project files, representing a potential attack surface. This risk is managed through path bounding and structural validation. Ingestion points: project files read in scripts/inspect_project.py, scripts/validate_project.py, and scripts/export_material.py. Boundary markers: explicitly defined in SKILL.md via allowed root directories (DCC_MCP_MATERIAL_MAKER_ALLOWED_ROOTS). Capability inventory: file-writing functionality in scripts/export_material.py. Sanitization: structural validation of graphs via the validate_project tool.
- [COMMAND_EXECUTION]: The skill invokes the Material Maker command-line interface to perform material exports. This behavior is restricted to documented CLI paths and uses validated, typed inputs to prevent unauthorized execution.
Audit Metadata