blockbench-substance
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto execute local Adobe Substance 3D binaries, includingsbsrender,sbscooker,sbsupdater, andsubstance3d_baker. These tools are located byscripts/sat_locate.pyin standard installation directories or the system PATH and are used to process 3D assets. - [DYNAMIC_EXECUTION]: The script
scripts/painter_remote.pyenables the agent to drive Adobe Substance 3D Painter programmatically. It sends Python or JavaScript code (Base64-encoded per API requirements) to a local Painter instance via HTTP onlocalhost:60041. This functionality is scoped to the local environment and the specific professional application. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as 3D models (
.obj,.glb) and Substance asset files (.sbsar,.sbs). While this represents a theoretical ingestion surface for indirect prompt injection, the skill utilizes established libraries (Pillow, numpy) and specialized Adobe binaries for processing, which is standard for media-related tasks.
Audit Metadata