tune-parameters
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill dynamically generates a Python script (
_tmp_usd_traverse.py) using theWritetool and subsequently executes it viaBash. This script uses thepxrlibrary to inspect USD stage properties such as units, axis, and bounding boxes. - [COMMAND_EXECUTION]: The skill performs shell-based probing and execution of external binaries including
ovrtx,usdrecord, andusdview. These tools are used for rendering screenshots and launching interactive 3D viewers based on user-provided USD paths. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes untrusted data.
- Ingestion points: The agent is instructed to read input USD files and operation-specific reStructuredText (
.rst) documentation files. - Boundary markers: The instructions do not define clear delimiters or warnings to prevent the agent from following potential instructions embedded within the metadata or structure of the USD files or the documentation.
- Capability inventory: The agent has access to
Bashfor shell command execution andWritefor file system modification. - Sanitization: There is no evidence of sanitization or safety-filtering for the content extracted from external files before it is processed by the agent.
- [SAFE]: The skill recommends the installation of
usd-coreviapip, which is a standard and well-known library for USD processing. - [SAFE]: All identified external tools and resources are consistent with the stated purpose of tuning NVIDIA Omniverse USD operations, representing legitimate vendor functionality.
Audit Metadata