dayz-p3d-inspector
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/p3d_inspector_viewer.pycontains a function_load_viewer_core()that dynamically locates and executes a shared dependency,viewer_core.py, by searching through parent and sibling directory structures. While the script performs content validation (checking for specific contract strings and versions) via AST parsing before execution, this pattern involves executing code from computed paths at runtime. - [COMMAND_EXECUTION]: The utility
scripts/install_py3d.pyuses thesubprocessmodule to executepipcommands (install,uninstall). This functionality is intended for managing a specific fork of thepy3dlibrary required for processing model files, but it allows the skill to modify the environment's package state. - [INDIRECT_PROMPT_INJECTION]: The skill processes external
.p3dbinary model files and structured.jsonrecipe data. These ingestion points represent an attack surface where maliciously crafted data could attempt to influence the agent's behavior during the extraction or inspection process. - [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of third-party Python dependencies (
numpy,py3d) and references external Three.js libraries from CDNs for its interactive viewer components.
Audit Metadata