dayz-model-pipeline
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and audit external 3D model files, referred to as 'Artist returns' in the 'Artist-return .p3d preflight' section of
SKILL.md. This constitutes an ingestion point for untrusted binary data that could theoretically contain malicious instructions in metadata fields. - Ingestion points: External
.p3dfiles are read using thepy3dlibrary as described inSKILL.mdandreferences/dayz-1-30-model-pipeline.md. - Boundary markers: The skill emphasizes 'Preflight' checks (LOD counts, bounding box verification) which serve as structural validation, but it lacks explicit LLM-level boundary markers for content within the binary format.
- Capability inventory: The skill has significant capabilities including file system access (reading/writing
.p3d,.png,.rvmat,.cpp,.cfgfiles) and execution of external tools (Blender). - Sanitization: The pipeline performs extensive geometric and structural sanitization (convexity, mass assigned, axis alignment) to ensure game compatibility, but does not specify textual sanitization for descriptive metadata strings within the processed files.
- [DYNAMIC_EXECUTION]: The skill generates and executes Python scripts within a headless Blender environment to produce 3D geometry.
- Evidence:
SKILL.mdandreferences/blender-headless.mddetail the use ofblender --background --python script.pyto automate modeling tasks such as primitive creation, modifier application, and OBJ export. - [COMMAND_EXECUTION]: The skill instructions include shell commands for setting up the environment and verifying tool versions.
- Evidence:
SKILL.mdprovides commands for installing system packages (apt-get install -y blender) and Python dependencies (pip install opensimplex,pip install -e tools/py3d), as well as version assertion checks usingpython3 -c.
Audit Metadata