contour-to-mesh
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/mask_to_mesh_recipe.pydynamically generates Python code for Blender by interpolating image-derived geometric data into a predefined script template. This generated code is subsequently executed within the Blender environment via themcp__blender__execute_blender_codetool. While the generation process uses local templates and standard data representations, the execution of dynamically generated code is a pattern that necessitates caution.- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection due to its processing of untrusted external image data which ultimately influences script generation and agent actions. * Ingestion points: External image data is loaded into the tool's context usingcv2.imread()within the provided Python scripts. * Boundary markers: The skill instructions do not include explicit delimiters or warnings to the agent to disregard potential instructions embedded within the image data or its metadata. * Capability inventory: The skill is grantedBashaccess for file manipulation and the ability to execute code viamcp__blender__execute_blender_code. * Sanitization: The skill mitigates risk by processing image data through strict geometric algorithms (contour extraction and Delaunay triangulation) and using therepr()function to safely interpolate the resulting numerical data into the Python script templates.
Audit Metadata