simready-foundation-create-package

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In assets/scripts/create_simready_package.py, runtime validation/capture flows into simready.validate and sr_pkg_sample/_conformance_writer.py builds conformance JSON by parsing AssetValidationResult.features_summary strings (including using eval on dependencies and failing requirements), so outsider-authored USD content can influence readable free-text fields consumed by the workflow.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The setup script and requirements reference and use https://pypi.nvidia.com/ at runtime (setup_venv.sh and pip install via requirements-package-sample.txt), which fetches and installs remote Python packages that the skill requires and therefore executes external code.