hy-3d-generation
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The scripts
main.py,submit_job.py, andquery_job.pyusesubprocess.check_callto ensure the requiredtencentcloud-sdk-pythonlibrary is installed in the environment. This is a standard practice for automated dependency management in standalone scripts.- [EXTERNAL_DOWNLOADS]: The skill automatically fetches the official Tencent Cloud SDK from the Python Package Index (PyPI). This download originates from a well-known service and is necessary for communicating with the AI3D API.- [PROMPT_INJECTION]: The instructions inSKILL.mdinclude a 'zero-interaction principle', directing the agent to execute model generation tasks without additional user confirmation. While this overrides standard interaction patterns, it is consistent with the skill's purpose as an automated tool.- [SAFE]: The skill exposes an indirect prompt injection surface by processing user-provided text prompts and image URLs. - Ingestion points: User input is ingested via the
--promptand--image-urlarguments inscripts/main.py. - Boundary markers: The skill does not implement explicit delimiters for these inputs.
- Capability inventory: Includes subprocess calls (for pip installation) and network operations (for API calls).
- Sanitization: No sanitization is performed on the input strings, but as they are passed to a domain-specific 3D generation API, the risk of cross-context instruction execution is minimal.
Audit Metadata