3dsmax-scripting

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents how to automate 3ds Max using command-line arguments, including execution of the primary binary (3dsmax.exe) with scripts and rendering parameters.
  • [DYNAMIC_EXECUTION]: The skill demonstrates dynamic loading and execution of MAXScript files using the fileIn command and automated scene loading via loadMaxFile within loop structures.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for reading data from external sources, such as JSON configuration files and existing scene files, which represents a potential attack surface for indirect prompt injection.
  • Ingestion points: The readJSON function and processAllScenes loop in SKILL.md are used to read and process external file data.
  • Boundary markers: The code does not implement specific boundary markers or instructions to ignore embedded prompts within the external data.
  • Capability inventory: The skill includes scripts that can write to the local file system (log creation and file exporting) and execute shell commands.
  • Sanitization: The provided examples do not include sanitization or validation logic for data ingested from external file paths or JSON fields.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 08:15 AM
Security Audit — agent-trust-hub — 3dsmax-scripting