openusd-composition
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides tools to mutate USD stage files by adding sublayers and payloads, which involves processing external files and identifiers.
- Ingestion points: Tool arguments in
tools.yaml(e.g.,stage_file,sublayer_path,payload_path) accept paths to external assets. - Boundary markers: None explicitly defined in the skill instructions.
- Capability inventory: The skill has file-write capabilities through the
dcc_mcp_openusdruntime to modify stage files. - Sanitization: The skill relies on the underlying
pxr(usd-core) library for validation of USD structures and asset resolution. - [EXTERNAL_DOWNLOADS]: The skill requires external dependencies including
dcc-mcp-coreand the well-knownpxr(usd-core) OpenUSD runtime. These resources are consistent with the vendor's provided tools and standard industry practices.
Audit Metadata