loop-gauntlet

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Python scripts to automate rendering and data logging within professional 3D software (Blender and Houdini). The self-test script (scripts/test_loop_scripts.py) utilizes subprocess.run to verify the skill's own components. This is a standard and safe implementation for local automation tools.
  • [DATA_EXPOSURE]: File access is strictly managed through user-provided configuration files (gauntlet_spec.json). The scripts read and write to specified working and reference directories, with no evidence of accessing sensitive system paths or hardcoded credentials.
  • [REMOTE_CODE_EXECUTION]: No patterns of remote script downloading or execution were identified. The skill relies on local scripts and established 3D software interfaces (MCP) for its operations.
  • [INDIRECT_PROMPT_INJECTION]: The prompt generation script (scripts/gauntlet_prompt.py) ingests data from a user-defined brief file. While this is an ingestion surface for untrusted data, the workflow is designed for individual artist use where the user controls the input. The script uses structural headers to delimit the ingested content, and its impact is limited to the local modeling session.
  • [EXTERNAL_DOWNLOADS]: The skill references standard Python libraries such as Pillow for image processing. These are well-known, trusted dependencies required for the skill's documented functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 07:18 AM