at-upa-scripting

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external 3D assets (CAD files), which constitutes a potential attack surface for indirect injection via file metadata or structures.
  • Ingestion points: The --input command-line parameter defined in the argparse block of all reference scripts (e.g., examples/import-tessellate-export-glb.py).
  • Boundary markers: The skill mandates using argparse as the exclusive input channel to ensure data is treated as parameters rather than executable instructions.
  • Capability inventory: The scripts utilize the pxz SDK for 3D processing and the standard os module for directory management (os.makedirs).
  • Sanitization: Input paths are normalized using os.path.abspath before being passed to the SDK operations.
  • [COMMAND_EXECUTION]: The example scripts perform necessary file system operations, such as creating output directories via os.makedirs. These operations are well-scoped to the /workspace convention described in the documentation and are required for the skill's primary function of asset transformation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 05:06 AM