The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/mx_groom.py makes extensive use of eval() and exec() to interface with Autodesk Maya's internal scripting engine (MEL). In the _menu_build function, the skill executes code strings retrieved directly from the software's UI metadata via cmds.menuItem(path, q=True, postMenuCommand=True). Additionally, the run_recipe function retrieves MEL code templates from a local JSON file (mx_groom_recipes.json), fills them with arguments, and executes them. This dynamic code generation and execution poses a security risk if the UI metadata or the local JSON recipes are manipulated by an attacker.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data formats, specifically Alembic (.abc) geometry files, through functions such as inspect_abc and measure_abc. These files are imported into the active Maya session, and their internal metadata (node names, attributes, and curve counts) is used to generate reports and influence the agent's logic (e.g., triggering the unreal_verdict gate). A maliciously crafted Alembic file could provide unexpected input to the agent's decision-making process.
[COMMAND_EXECUTION]: The skill uses maya.mel.eval throughout scripts/mx_groom.py to run shell-like commands within the Maya environment, including file operations, render overrides, and UI manipulations. While standard for Maya automation, this capability increases the impact of any potential injection.
[EXTERNAL_DOWNLOADS]: SKILL.md contains instructions for the agent to prompt the user to install additional skills using npx skills add scenario-labs/skills. Although this points to the author's own ecosystem, it provides a vector for the agent to introduce new, external code into its execution environment.

scenario-maya-groom