contour-to-mesh

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/mask_to_mesh_recipe.py dynamically generates Python code for Blender by interpolating image-derived geometric data into a predefined script template. This generated code is subsequently executed within the Blender environment via the mcp__blender__execute_blender_code tool. While the generation process uses local templates and standard data representations, the execution of dynamically generated code is a pattern that necessitates caution.- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection due to its processing of untrusted external image data which ultimately influences script generation and agent actions. * Ingestion points: External image data is loaded into the tool's context using cv2.imread() within the provided Python scripts. * Boundary markers: The skill instructions do not include explicit delimiters or warnings to the agent to disregard potential instructions embedded within the image data or its metadata. * Capability inventory: The skill is granted Bash access for file manipulation and the ability to execute code via mcp__blender__execute_blender_code. * Sanitization: The skill mitigates risk by processing image data through strict geometric algorithms (contour extraction and Delaunay triangulation) and using the repr() function to safely interpolate the resulting numerical data into the Python script templates.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 11:24 AM