vector-style
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill uses
runpy.run_pathto load and execute Python scripts from other local skills (stylized-style, lighting, rendering, etc.). The paths are constructed dynamically using string interpolation of a skills directory variable. - [INDIRECT_PROMPT_INJECTION]: The skill accepts a
targetidentifier for a Blender object which is interpolated directly into script arguments. This creates a surface where unverified object names could influence the execution of downstream scripts. - Ingestion points: The
targetvariable within the Python script block inSKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded content are used for the interpolated target.
- Capability inventory: File execution via
runpy.run_path, scene object modification, and render parameter control. - Sanitization: No sanitization or validation logic is applied to the
targetstring before it is passed to dependencies.
Audit Metadata