scenario-zbrush-pose-print
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill uses a bridge to execute dynamically generated Python code within the ZBrush application environment. The code strings are assembled in
scripts/zb_pose.pyand are used to control the internal application API. - [COMMAND_EXECUTION]: Inter-process automation is achieved by sending Python scripts to a local socket bridge that controls ZBrush. This is a standard and well-documented architectural pattern for the skill's intended professional use.
- [INDIRECT_PROMPT_INJECTION]: The skill processes 3D model files (OBJ, STL, 3MF) provided as external data. While this creates an attack surface for data-driven injection, the risk is mitigated through geometric analysis logic and the use of robust serialization for inter-process communication.
- Ingestion points: Mesh parsing and loading functions in
scripts/zb_print.py. - Boundary markers: Not applicable (processed as structured geometric data).
- Capability inventory: File system writes (exports) and ZBrush automation via a local socket bridge.
- Sanitization: Inter-process communication utilizes
json.dumpsto ensure that data passed to the executable bridge environment is safely encoded.
Audit Metadata