topview-3d-cli
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the topview-3d-cli package from the official PyPI registry and downloads the Chromium browser via Playwright for rendering purposes.\n- [COMMAND_EXECUTION]: Extensively uses shell commands to interact with the topview-3d-cli tool for 3D scene manipulation, rendering, and project management.\n- [PRIVILEGE_ESCALATION]: Uses sudo on Linux systems to install system dependencies for the Chromium browser when running topview-3d-cli browser ensure --with-deps.\n- [PERSISTENCE]: Modifies the Cursor IDE's MCP configuration file (~/.cursor/mcp.json) to register the vendor's MCP server (https://mcp-browser.topview.ai).\n- [INDIRECT_PROMPT_INJECTION]: Processes external 3D models (.glb, .gltf) and visual reference data (images, videos) which are used to generate prompts for downstream AI video generation services. The skill includes instructions to provide users with summaries and prompt previews to mitigate risks.
Audit Metadata