scenario-zbrush-sculpting
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a well-documented tool for ZBrush automation. No malicious code, credential theft, or unauthorized network activity was detected. Analysis of the scripts and instructions reveals standard development practices for controlling external 3D software.- [DYNAMIC_EXECUTION]: The skill uses Python templates in
scripts/zb_sculpt.pyto generate commands for thezb_launchbridge. These commands automate sculpting actions like brush strokes and mesh remeshing. The templates are statically defined and do not incorporate unvalidated external code, posing no risk to the host system.- [INDIRECT_PROMPT_INJECTION]: The skill ingests 3D model data (OBJ) and application state which represents a potential attack surface. However, the risk is assessed as safe because the capabilities are restricted to ZBrush operations and local file management for model versioning. - Ingestion points: 3D model files (OBJ) and ZBrush scene state data (
scripts/zb_sculpt.py,Scene.capture). - Boundary markers: Not applicable; data is interpreted as geometric and state parameters.
- Capability inventory: File system access for writing ZTL, OBJ, and PNG files; ZBrush-specific command execution via bridge.
- Sanitization: Structured data formats (JSON) are used for state communication, and the skill performs geometric audits (vertex counts, IoU) on ingested models.
Audit Metadata