skills/theorcdev/skills/rig-it/Gen Agent Trust Hub

rig-it

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [SAFE]: The skill operates as a local utility for Blender character rigging. It performs geometrical and mathematical operations on 3D assets with no network access or data transmission logic.
  • [COMMAND_EXECUTION]: The skill orchestrates pipelines using subprocess.run to call Blender and FFmpeg. These calls use list-based arguments and shlex for safe parameter passing, which prevents shell injection vulnerabilities.
  • [REMOTE_CODE_EXECUTION]: Analysis confirmed there are no routines for downloading or executing remote code. The skill relies on pre-installed local dependencies like Pillow and FFmpeg.
  • [OBFUSCATION]: No obfuscated payloads, base64-encoded commands, zero-width characters, or homoglyph attacks were detected in any of the scripts or metadata.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external 3D files but mitigates potential injection risks by utilizing Blender's --factory-startup flag and using deterministic parsing logic that does not evaluate model metadata as executable instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 02:52 PM