physical-ai-defect-image-generation
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Several workflow configuration files (e.g.,
assets/configs/finetune.yaml,assets/configs/good_image_generation.yaml) download theyqutility directly from its official GitHub repository (github.com/mikefarah/yq) during task execution to manipulate configuration files in-pod. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data including CAD USD files, real optical photos, and validation metrics from user-defined storage roots. It also instructs the agent to monitor workflow logs for status updates.
- Ingestion points: External datasets, validation CSVs (
valid_kpi.csv), and real-time task logs are ingested into the agent's context. - Boundary markers: Absent; external data and log outputs are not enclosed in delimiters.
- Capability inventory: The skill utilizes
ShellandReadtools to executeosmoCLI commands, manage filesystem assets, and monitor logs. - Sanitization: No explicit sanitization or filtering of external data content is implemented prior to processing.
- [COMMAND_EXECUTION]: The skill uses various shell scripts (
scripts/preflight_credentials.sh,scripts/preflight_urls.sh, etc.) and inline shell commands within YAML configurations to orchestrate the Defect Image Generation (DIG) pipeline, including environment setup and workflow submission.
Audit Metadata