creator-hub-mcp

Pass

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides shell commands for environment health checks and process management. Specifically, it uses stat and ls to verify file modification times, and utility commands like pgrep, pkill, Stop-Process, and Wait-Process to manage the Decentraland Explorer and its watchdog process during preview cycles.
  • [EXTERNAL_DOWNLOADS]: The instructions direct the agent to install additional capabilities using npx skills add decentraland/sdk-skills. These resources are hosted in the official Decentraland organization's repository and are part of the standard toolset for the platform.
  • [DYNAMIC_EXECUTION]: The skill enables the use of 'Script Components' by instructing the agent to author .tsx files in the assets/Scripts/ directory and then dynamically attach them to scene entities using the attach_script tool. This is a core feature of the SDK for implementing custom scene logic.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external assets attached by users, such as GLB models, images, and audio files. While these files are treated as binary assets, their ingestion represents a potential attack surface for indirect instructions hidden in file metadata or content.
  • [DATA_EXPOSURE]: The agent is instructed to access and read files via absolute paths provided by the user through the editor's attachment interface. This allows the agent to import 3D models and textures from the local disk into the project environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 24, 2026, 10:30 PM