pascal-3d
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to perform or guide users through setup tasks using shell commands like 'npm install', 'pascal mcp setup', and 'claude mcp add'. These are legitimate requirements for establishing the MCP connection to the Pascal editor.
- [EXTERNAL_DOWNLOADS]: The setup process involves downloading the '@pascal-app/cli' package from the npm registry. This is a functional dependency owned by the vendor and is necessary for the skill's local 3D modeling capabilities.
- [DYNAMIC_EXECUTION]: The skill facilitates the generation and execution of three.js and Blender Python (bpy) scripts to create custom 3D objects. These scripts are authored by the agent based on user design requirements and are executed within the Pascal editor or backend services.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external 3D scene graphs, asset catalogs, and metadata (ingestion points: 'load_scene', 'list_captures', 'view_assets'). While this presents a surface for injection, the skill includes instructional boundary markers to treat this data as non-authoritative. The capability inventory is scoped to modeling tools and authorized setup commands, and while automated sanitization is not specified, the agent is directed to maintain the data boundary.
Audit Metadata