skin-weights
Warn
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/export_rigc.pydefines a hardcoded TypeScript code block (POSER) which is written to a temporary file and executed using thebunruntime during the verification process. The generated script performs dynamic module loading (await import(...)) based on the--verify-rigcpath argument provided by the user. - [COMMAND_EXECUTION]: Multiple scripts, including
scripts/export_rigc.pyandscripts/test_skin_weights.py, utilizesubprocess.runto execute external commands such as thebunruntime and other Python scripts. While shell execution is not enabled, these operations rely on external binaries being present on the system path and use paths provided as arguments. - [DYNAMIC_EXECUTION]: The script
scripts/test_skin_weights.pyuses the__import__function to dynamically load theskinlibmodule at runtime for internal operations. - [DYNAMIC_EXECUTION]: In
scripts/test_skin_weights.py, the code attempts to locate and potentially execute an external script (audit_skin.py) from a relative sibling directory (spine-skeletal), which involves dynamic loading from computed filesystem paths.
Audit Metadata