The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/zb_paint.py dynamically constructs and formats Python code blocks to be executed within the ZBrush environment via the zb_launch bridge. This mechanism is used to synchronize the agent's logic with the 3D application's internal state. While it uses json.dumps to sanitize arguments, the runtime assembly of executable code is a significant capability.
[COMMAND_EXECUTION]: The skill uses the subprocess.run function in scripts/zb_paint.py to execute the ffmpeg command-line utility. This is used to assemble rendered image frames into turntable videos (MP4) or animated GIFs. The command is executed with a list of arguments and doesn't use the shell, which reduces injection risks.
[INDIRECT_PROMPT_INJECTION]: The skill processes external assets such as textures, mesh data, and user-provided configuration strings (sex, age, build, skin tone) to drive ZBrush operations. This creates an attack surface where maliciously crafted data could potentially influence the agent's decisions during the painting and rendering workflow. The skill lacks explicit sanitization for these inputs before they are interpolated into the workflow logic.
[DATA_EXPOSURE_&_EXFILTRATION]: The skill performs extensive file system operations, including reading and writing ZBrush Tool files (.ZTL), images (.png, .jpg), and OBJ files. It also reads the ZBrush UI string table and exports renders to local paths. While these operations are directed at the skill's primary purpose, they involve the handling of project data.

scenario-zbrush-paint-render