world-labs-marble
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents capabilities for processing untrusted external data—including natural language prompts, images, and video—which are transmitted to the World API for 3D reconstruction.
- Ingestion points: The skill accepts text, single images, multiple images, videos, and 360 panoramas as input for world generation (SKILL.md).
- Boundary markers: The documentation does not specify the use of delimiters or instructions to ignore embedded commands within user-provided inputs.
- Capability inventory: The skill uses the World API to generate, edit, and export persistent 3D geometry and video renders (SKILL.md).
- Sanitization: No input validation or sanitization mechanisms for the external data sources are mentioned in the instructions.
- [SAFE]: All external URLs and resources cited in the documentation belong to the primary vendor, well-known technology news outlets, or established technical libraries for 3D rendering.
Audit Metadata