blockbench-substance

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to execute local Adobe Substance 3D binaries, including sbsrender, sbscooker, sbsupdater, and substance3d_baker. These tools are located by scripts/sat_locate.py in standard installation directories or the system PATH and are used to process 3D assets.
  • [DYNAMIC_EXECUTION]: The script scripts/painter_remote.py enables the agent to drive Adobe Substance 3D Painter programmatically. It sends Python or JavaScript code (Base64-encoded per API requirements) to a local Painter instance via HTTP on localhost:60041. This functionality is scoped to the local environment and the specific professional application.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as 3D models (.obj, .glb) and Substance asset files (.sbsar, .sbs). While this represents a theoretical ingestion surface for indirect prompt injection, the skill utilizes established libraries (Pillow, numpy) and specialized Adobe binaries for processing, which is standard for media-related tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 11:06 PM