dreamina-3d-use
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests environmental data by probing the filesystem for installed Blender or Maya plugins to determine its routing logic. This could potentially be influenced by malicious software providing misleading metadata on the host system.\n
- Ingestion points: The
discover_companions(search_roots)function call referenced inSKILL.md.\n - Boundary markers: The skill includes an explicit 'Never do' section and mandatory 'Gate signals' (e.g.,
PreviewValidated,Completed) to verify states.\n - Capability inventory: Invocation of local scripts and delegation to external rendering sub-skills (
codex-dreamina-3d-auto-seedance, etc.).\n - Sanitization: Employs SHA256 integrity checks for downloaded results and requires user approval for all submissions.\n- [DYNAMIC_EXECUTION]: The skill executes a local Python script to detect system capabilities at runtime.\n
- Evidence: The workflow instructions require calling
discover_companionsfromscripts/capability_probe.py.
Audit Metadata