compare-stages

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill instructs the agent to write a temporary Python script (_compare_stages.py) to the OS temporary directory and execute it via the Shell tool. This is used to analyze USD stage metrics programmatically.
  • [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The instructions recommend installing usd-core==25.11 via pip. This is a well-known package from a trusted industry context (NVIDIA/Pixar) and is version-pinned to ensure stability and reduce supply chain risk.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external USD assets and CSV validator reports. The risk is considered low as the extraction is limited to numeric counts (prims, vertices, faces) and basic metadata (upAxis, metersPerUnit) which are not interpreted as instructions for the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 07:55 AM
Security Audit — agent-trust-hub — compare-stages