physical-ai-defect-image-generation

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Several workflow configuration files (e.g., assets/configs/finetune.yaml, assets/configs/good_image_generation.yaml) download the yq utility directly from its official GitHub repository (github.com/mikefarah/yq) during task execution to manipulate configuration files in-pod.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data including CAD USD files, real optical photos, and validation metrics from user-defined storage roots. It also instructs the agent to monitor workflow logs for status updates.
  • Ingestion points: External datasets, validation CSVs (valid_kpi.csv), and real-time task logs are ingested into the agent's context.
  • Boundary markers: Absent; external data and log outputs are not enclosed in delimiters.
  • Capability inventory: The skill utilizes Shell and Read tools to execute osmo CLI commands, manage filesystem assets, and monitor logs.
  • Sanitization: No explicit sanitization or filtering of external data content is implemented prior to processing.
  • [COMMAND_EXECUTION]: The skill uses various shell scripts (scripts/preflight_credentials.sh, scripts/preflight_urls.sh, etc.) and inline shell commands within YAML configurations to orchestrate the Defect Image Generation (DIG) pipeline, including environment setup and workflow submission.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 11:51 PM