rig-it
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill operates as a local utility for Blender character rigging. It performs geometrical and mathematical operations on 3D assets with no network access or data transmission logic.
- [COMMAND_EXECUTION]: The skill orchestrates pipelines using
subprocess.runto call Blender and FFmpeg. These calls use list-based arguments andshlexfor safe parameter passing, which prevents shell injection vulnerabilities. - [REMOTE_CODE_EXECUTION]: Analysis confirmed there are no routines for downloading or executing remote code. The skill relies on pre-installed local dependencies like Pillow and FFmpeg.
- [OBFUSCATION]: No obfuscated payloads, base64-encoded commands, zero-width characters, or homoglyph attacks were detected in any of the scripts or metadata.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external 3D files but mitigates potential injection risks by utilizing Blender's
--factory-startupflag and using deterministic parsing logic that does not evaluate model metadata as executable instructions.
Audit Metadata