usd-brep-tools-python-gui
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for executing local validation and rendering scripts through the
uvpackage manager, which ensures a controlled environment. - Evidence: Validation instructions use
uv run --locked --group gui python tools/scripts/smlib_gui_smoke.pyto test workbench changes. - [DYNAMIC_EXECUTION]: The maintained tool is a developer workbench designed for interactive Python script execution and history management, facilitating a debugger-centric workflow.
- Evidence: The skill defines the primary workbench purpose as managing "script execution/history" and preserving the reproducibility of UI-generated commands.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external geometric model files (e.g., USD, OCCT, SMLib), creating an ingestion surface for potentially untrusted data.
- Ingestion points: Data is loaded via the shared dispatch logic in
tools/smlib_gui/operations/file_io.py. - Boundary markers: Boundary markers for model parsing are not explicitly defined in the skill documentation.
- Capability inventory: The skill uses isolated subprocesses for rendering and performs file system operations to save composite screenshots and render reports.
- Sanitization: A strong mitigation is implemented through isolated model workers (
--jobs N), which ensures that malformed inputs or worker failures do not corrupt the host process or affect other rendering tasks.
Audit Metadata