tune-parameters

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill dynamically generates a Python script (_tmp_usd_traverse.py) using the Write tool and subsequently executes it via Bash. This script uses the pxr library to inspect USD stage properties such as units, axis, and bounding boxes.
  • [COMMAND_EXECUTION]: The skill performs shell-based probing and execution of external binaries including ovrtx, usdrecord, and usdview. These tools are used for rendering screenshots and launching interactive 3D viewers based on user-provided USD paths.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes untrusted data.
  • Ingestion points: The agent is instructed to read input USD files and operation-specific reStructuredText (.rst) documentation files.
  • Boundary markers: The instructions do not define clear delimiters or warnings to prevent the agent from following potential instructions embedded within the metadata or structure of the USD files or the documentation.
  • Capability inventory: The agent has access to Bash for shell command execution and Write for file system modification.
  • Sanitization: There is no evidence of sanitization or safety-filtering for the content extracted from external files before it is processed by the agent.
  • [SAFE]: The skill recommends the installation of usd-core via pip, which is a standard and well-known library for USD processing.
  • [SAFE]: All identified external tools and resources are consistent with the stated purpose of tuning NVIDIA Omniverse USD operations, representing legitimate vendor functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 07:55 AM
Security Audit — agent-trust-hub — tune-parameters