omniverse-gaussian-splat-to-usd
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use the
Shelltool for executing conversion commands (usd-convert-gsplat) and running repository build scripts (repo.bat,repo.sh). These actions are consistent with the skill's stated purpose of facilitating 3D asset conversion and development workflows. - [EXTERNAL_DOWNLOADS]: The skill contains instructions to install Python packages from local paths (e.g.,
pip install ./source/python). This is a standard practice for installing dependencies bundled with a repository. - [PROMPT_INJECTION]: The skill processes external data in the form of
.plyand.spzfiles. - Ingestion points: Untrusted data enters the agent context when reading
.plyor.spzsource files for conversion. - Boundary markers: No explicit boundary markers or instructions to ignore embedded content are provided for the input data.
- Capability inventory: The skill has access to the
Shelltool, enabling file system writes and command execution. - Sanitization: There is no explicit mention of sanitizing the content of the 3D data files before processing.
- While these files are structured binary/numeric 3D data formats rather than natural language, they represent a potential attack surface for indirect prompt injection if the parser interprets metadata or comments as instructions. (Internal Severity: LOW)
Audit Metadata