bonsai-syntax-properties

Pass

Audited by Gen Agent Trust Hub on Mar 17, 2026

Risk Level: SAFE
Full Analysis
  • [PROMPT_INJECTION]: The skill contains only technical instructions for AEC (Architecture, Engineering, and Construction) workflows and does not attempt to override agent safety or system instructions.
  • [DATA_EXFILTRATION]: No network operations, sensitive file path access, or credential exposure were detected. The operations are confined to IFC model manipulation.
  • [OBFUSCATION]: No encoded strings, hidden characters, or obfuscated URLs were found within the documentation or code snippets.
  • [REMOTE_CODE_EXECUTION]: No remote script execution patterns (e.g., piping curl to a shell) were identified. The library-specific ifcopenshell.api.run is a standard dispatcher for the BIM toolkit.
  • [COMMAND_EXECUTION]: No dangerous system commands or subprocess calls are present. The snippets focus on the ifcopenshell Python API.
  • [PRIVILEGE_ESCALATION]: The skill does not use sudo, modify system permissions, or attempt to acquire elevated access.
  • [PERSISTENCE]: No mechanisms for establishing persistence, such as modifying startup scripts or cron jobs, are included.
  • [METADATA_POISONING]: Metadata fields are legitimate and provide accurate information about the skill's authorship and version.
  • [INDIRECT_PROMPT_INJECTION]: While the skill describes processing external IFC files, it defines clear patterns for structured data manipulation and does not expose dangerous capabilities to the processed data.
  • [DYNAMIC_EXECUTION]: No use of eval(), exec(), or unsafe deserialization like pickle was observed in the provided examples.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 17, 2026, 06:30 PM