3d-model-generation
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous
curlcommand examples in the documentation to demonstrate API interactions for asset generation. These commands are intended for manual or agent-driven use and do not involve piped execution or unsafe system modifications. - [EXTERNAL_DOWNLOADS]: The skill references several external resources under the
eachlabs.runandeachlabs.aidomains for API endpoints and asset storage. These are vendor-owned resources consistent with the skill's stated purpose of providing 3D model generation services. - [INDIRECT_PROMPT_INJECTION]: The skill functions as a wrapper for generative AI and presents a surface for processing untrusted data.
- Ingestion points: User-provided text prompts in the
messagesfield and external image links in theimage_urlsfield serve as data ingestion points in theSKILL.mdfile. - Boundary markers: The instructions do not define specific delimiters or instructions to prevent the processing of potentially malicious instructions embedded in the input data.
- Capability inventory: The skill facilitates network requests to the EachLabs API service for model generation.
- Sanitization: There are no mentioned mechanisms for sanitizing user-supplied text or validating the safety of external image URLs before processing.
Audit Metadata