vector-style

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill uses runpy.run_path to load and execute Python scripts from other local skills (stylized-style, lighting, rendering, etc.). The paths are constructed dynamically using string interpolation of a skills directory variable.
  • [INDIRECT_PROMPT_INJECTION]: The skill accepts a target identifier for a Blender object which is interpolated directly into script arguments. This creates a surface where unverified object names could influence the execution of downstream scripts.
  • Ingestion points: The target variable within the Python script block in SKILL.md.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded content are used for the interpolated target.
  • Capability inventory: File execution via runpy.run_path, scene object modification, and render parameter control.
  • Sanitization: No sanitization or validation logic is applied to the target string before it is passed to dependencies.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 06:05 PM