spatial-sdk-scene-builder
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill identifies and installs standard 3D processing dependencies including 'trimesh', 'networkx', and 'usd-core' from the official Python Package Index (PyPI) to support its core measurement functions.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external 3D model files (.glb, .gltf, .usdz) to extract physical dimensions, which introduces a potential attack surface via the underlying parsing libraries.\n
- Ingestion points: 3D asset files provided in the user's project directory or specified by path (SKILL.md Step 2).\n
- Boundary markers: No specific delimiters are used for the binary content of the 3D models.\n
- Capability inventory: The skill is authorized to run local Python scripts via Bash and write structured JSON output to the '.spatialsdk/' directory.\n
- Sanitization: The 'calculate_bbox.py' script performs basic validation by checking file existence and verifying the file extension before processing.
Audit Metadata