guitar-gear-modeling

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill instructs the agent to use Python scripts for automating modeling operations, batching construction tasks, and managing render processes.
  • Evidence: SKILL.md and references/blender-operations.md explicitly define a workflow that utilizes "deterministic Blender Python for repeatable construction or render batches" and "scoped, reproducible Python for repeated construction."
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted user data, including product briefs and reference specifications, which are used to influence the modeling logic and generated scripts.
  • Ingestion points: templates/product-brief.md and user-provided reference images/descriptions.
  • Boundary markers: The templates/accepted-constraints.md ledger is used to differentiate between "AUTHORITATIVE USER FACTS" and "PHOTO-INFERRED" data.
  • Capability inventory: The skill can generate and execute Python code, perform file operations (saving .blend, .glb, and .png files), and configure system-level execution via Blender CLI arguments.
  • Sanitization: The instructions do not specify automated validation or sanitization of input data before its use in modeling parameters or script generation.
  • [COMMAND_EXECUTION]: The workflow involves interacting with the host system to locate the Blender executable and configuring command-line arguments for background processing.
  • Evidence: references/blender-operations.md provides guidance on arranging CLI arguments so intended files load before scripts run and supplying discovered executable paths to the environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 08:23 PM