hy-3d-generation

Pass

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The scripts main.py, submit_job.py, and query_job.py use subprocess.check_call to ensure the required tencentcloud-sdk-python library is installed in the environment. This is a standard practice for automated dependency management in standalone scripts.- [EXTERNAL_DOWNLOADS]: The skill automatically fetches the official Tencent Cloud SDK from the Python Package Index (PyPI). This download originates from a well-known service and is necessary for communicating with the AI3D API.- [PROMPT_INJECTION]: The instructions in SKILL.md include a 'zero-interaction principle', directing the agent to execute model generation tasks without additional user confirmation. While this overrides standard interaction patterns, it is consistent with the skill's purpose as an automated tool.- [SAFE]: The skill exposes an indirect prompt injection surface by processing user-provided text prompts and image URLs.
  • Ingestion points: User input is ingested via the --prompt and --image-url arguments in scripts/main.py.
  • Boundary markers: The skill does not implement explicit delimiters for these inputs.
  • Capability inventory: Includes subprocess calls (for pip installation) and network operations (for API calls).
  • Sanitization: No sanitization is performed on the input strings, but as they are passed to a domain-specific 3D generation API, the risk of cross-context instruction execution is minimal.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 15, 2026, 07:11 AM
Security Audit — agent-trust-hub — hy-3d-generation