scenario-patina-retexture

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run and subprocess.check_output in scripts/film.py and scripts/worker.py to drive local installations of Blender, ffmpeg, and ffprobe. These executions are essential for rendering 3D scenes and encoding video files as part of the material comparison workflow. The commands are constructed using parameters from user-provided configuration files.
  • [EXTERNAL_DOWNLOADS]: Instructions in SKILL.md specify the use of curl -fL to download 3D mesh files and generated material maps from the Scenario platform. These downloads are necessary for the skill's primary function and target resources managed through the Scenario MCP server.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of 3D asset files and JSON material manifests. To mitigate risks, the skill implements validation routines in scripts/apply_materials.py and uses SHA-256 geometry hashing to ensure that 3D meshes are not unexpectedly modified during the material application process.
  • [DYNAMIC_EXECUTION]: The skill uses Blender's Python API (bpy) to programmatically modify 3D scenes and trigger renders. This behavior is standard for Blender-based automation and is confined to the local execution environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 02:59 PM