openusd-composition

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill provides tools to mutate USD stage files by adding sublayers and payloads, which involves processing external files and identifiers.
  • Ingestion points: Tool arguments in tools.yaml (e.g., stage_file, sublayer_path, payload_path) accept paths to external assets.
  • Boundary markers: None explicitly defined in the skill instructions.
  • Capability inventory: The skill has file-write capabilities through the dcc_mcp_openusd runtime to modify stage files.
  • Sanitization: The skill relies on the underlying pxr (usd-core) library for validation of USD structures and asset resolution.
  • [EXTERNAL_DOWNLOADS]: The skill requires external dependencies including dcc-mcp-core and the well-known pxr (usd-core) OpenUSD runtime. These resources are consistent with the vendor's provided tools and standard industry practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 06:49 AM