blockbench-albedo-to-pbr
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches machine learning models for depth estimation from Hugging Face's official repositories when the
--height-source depthoption is used. These downloads are handled by the standardtransformersand@huggingface/transformerslibraries. - [COMMAND_EXECUTION]: The skill includes Python and Node.js scripts designed to be executed via the command line for texture processing. These scripts utilize well-known image processing and machine learning libraries like Pillow, torch, and vgpu.
- [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface where instructions could be hidden in processed image files or their metadata. However, the processing is limited to numerical transformations for texture generation.
- Ingestion points: Input image files provided through command-line arguments (e.g.,
albedo.png,height-file). - Boundary markers: None present.
- Capability inventory: File system read/write and GPU/CPU compute operations for image manipulation.
- Sanitization: Input file paths are resolved through standard library calls, while image content is processed via mathematical kernels.
Audit Metadata