decentraland-sdk-skills
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides numerous commands to download 3D models and audio assets from official and vendor-related domains such as
builder-items.decentraland.organdmodels.dclregenesislabs.xyz. These operations are fundamental to the skill's purpose of asset management and scene construction. - [COMMAND_EXECUTION]: The documentation includes shell scripts (using
node -e) designed to be run locally for analyzing 3D model properties, such as calculating bounding boxes and detecting collider meshes. These are standard development utilities. - [INDIRECT_PROMPT_INJECTION]: The skill describes processes for fetching external data, such as avatar profiles from the Decentraland Catalyst API (
peer.decentraland.org). While this creates an ingestion surface for untrusted data, the instructions focus on technical data mapping (e.g., applying wearable URNs to components) rather than prompt interpolation, and the risk is mitigated by platform-level guardrails. - [REMOTE_CODE_EXECUTION]: The skill recommends the installation of several community and vendor-provided npm packages, including
eth-connect,dcl-crypto-toolkit, anddcl-npc-toolkit. These are standard libraries within the Decentraland development ecosystem.
Audit Metadata