blitz3d-decomp

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to clone the B3DDecomp repository from GitHub and download the .NET SDK using the official dotnet-install.ps1 script. These are necessary components for the reverse engineering process described in the skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests untrusted binary data from game executables (.exe) and model files (.b3d).
  • Ingestion points: Blitz3DDecomp.exe processes game binaries; b3d_skin.py parses .b3d model files; vm_anim_data.py processes JSON intermediate files.
  • Boundary markers: The skill instructions include explicit 'stop' conditions when encountering protected builds and reference safety guidelines for intellectual property.
  • Capability inventory: The skill environment includes dotnet, python, and blender for processing and conversion.
  • Sanitization: The conversion scripts perform structured parsing of specific binary formats, which limits the potential for arbitrary instruction execution from within data files.
  • [DYNAMIC_EXECUTION]: The script vm_anim_data.py generates a .luau data module containing Base64-encoded animation keyframes. This is a standard method for packaging assets for the Roblox runtime and does not involve executing untrusted code at runtime.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 10:21 PM