turntable
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts within the Blender environment to manipulate 3D scenes and runs ffmpeg commands via the shell to encode video sequences.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) because user-provided parameters are interpolated directly into executable Python and shell code blocks.
- Ingestion points: Variable placeholders such as
<OBJECT_NAME>,<OUTPUT>, and numeric parameters likedurationandfpsinSKILL.md. - Boundary markers: None. The skill does not use delimiters or instructions to the agent to treat these inputs strictly as data.
- Capability inventory: The skill uses the
osmodule for directory management, thebpyAPI for Blender automation, and shell access for ffmpeg processing. - Sanitization: There is no evidence of validation or escaping for the parameters before they are inserted into scripts.
Audit Metadata