usd-brep-tools-python-gui

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for executing local validation and rendering scripts through the uv package manager, which ensures a controlled environment.
  • Evidence: Validation instructions use uv run --locked --group gui python tools/scripts/smlib_gui_smoke.py to test workbench changes.
  • [DYNAMIC_EXECUTION]: The maintained tool is a developer workbench designed for interactive Python script execution and history management, facilitating a debugger-centric workflow.
  • Evidence: The skill defines the primary workbench purpose as managing "script execution/history" and preserving the reproducibility of UI-generated commands.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external geometric model files (e.g., USD, OCCT, SMLib), creating an ingestion surface for potentially untrusted data.
  • Ingestion points: Data is loaded via the shared dispatch logic in tools/smlib_gui/operations/file_io.py.
  • Boundary markers: Boundary markers for model parsing are not explicitly defined in the skill documentation.
  • Capability inventory: The skill uses isolated subprocesses for rendering and performs file system operations to save composite screenshots and render reports.
  • Sanitization: A strong mitigation is implemented through isolated model workers (--jobs N), which ensures that malformed inputs or worker failures do not corrupt the host process or affect other rendering tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 09:29 AM