at-upa-scripting
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external 3D assets (CAD files), which constitutes a potential attack surface for indirect injection via file metadata or structures.
- Ingestion points: The
--inputcommand-line parameter defined in theargparseblock of all reference scripts (e.g.,examples/import-tessellate-export-glb.py). - Boundary markers: The skill mandates using
argparseas the exclusive input channel to ensure data is treated as parameters rather than executable instructions. - Capability inventory: The scripts utilize the
pxzSDK for 3D processing and the standardosmodule for directory management (os.makedirs). - Sanitization: Input paths are normalized using
os.path.abspathbefore being passed to the SDK operations. - [COMMAND_EXECUTION]: The example scripts perform necessary file system operations, such as creating output directories via
os.makedirs. These operations are well-scoped to the/workspaceconvention described in the documentation and are required for the skill's primary function of asset transformation.
Audit Metadata