skin-weights

Warn

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/export_rigc.py defines a hardcoded TypeScript code block (POSER) which is written to a temporary file and executed using the bun runtime during the verification process. The generated script performs dynamic module loading (await import(...)) based on the --verify-rigc path argument provided by the user.
  • [COMMAND_EXECUTION]: Multiple scripts, including scripts/export_rigc.py and scripts/test_skin_weights.py, utilize subprocess.run to execute external commands such as the bun runtime and other Python scripts. While shell execution is not enabled, these operations rely on external binaries being present on the system path and use paths provided as arguments.
  • [DYNAMIC_EXECUTION]: The script scripts/test_skin_weights.py uses the __import__ function to dynamically load the skinlib module at runtime for internal operations.
  • [DYNAMIC_EXECUTION]: In scripts/test_skin_weights.py, the code attempts to locate and potentially execute an external script (audit_skin.py) from a relative sibling directory (spine-skeletal), which involves dynamic loading from computed filesystem paths.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 30, 2026, 08:21 PM