usd-pipeline
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The documentation provides instructions for setting up virtual framebuffers (Xvfb) and executing simulator scripts. These are standard operational procedures for headless 3D rendering and do not involve unauthorized privilege escalation or malicious intent.
- [INDIRECT_PROMPT_INJECTION]: The skill processes USD files which could theoretically serve as an attack vector for indirect injection if the agent interpolates file metadata into prompts.
- Ingestion points:
scripts/measure_asset.pyandscripts/place_assets.pyingest and parse USD files to extract bounding box and shader data. - Boundary markers: Absent. The scripts rely on the Pixar USD (pxr) library's native parsing capabilities.
- Capability inventory: Includes file system write operations via
stage.GetRootLayer().Save()and USD prim manipulation within the simulation environment. - Sanitization: The skill performs technical data extraction (coordinates, prim counts) using a structured library. No natural language content from the files is interpolated into the agent's instructions.
Audit Metadata