dayz-p3d-inspector

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/p3d_inspector_viewer.py contains a function _load_viewer_core() that dynamically locates and executes a shared dependency, viewer_core.py, by searching through parent and sibling directory structures. While the script performs content validation (checking for specific contract strings and versions) via AST parsing before execution, this pattern involves executing code from computed paths at runtime.
  • [COMMAND_EXECUTION]: The utility scripts/install_py3d.py uses the subprocess module to execute pip commands (install, uninstall). This functionality is intended for managing a specific fork of the py3d library required for processing model files, but it allows the skill to modify the environment's package state.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external .p3d binary model files and structured .json recipe data. These ingestion points represent an attack surface where maliciously crafted data could attempt to influence the agent's behavior during the extraction or inspection process.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of third-party Python dependencies (numpy, py3d) and references external Three.js libraries from CDNs for its interactive viewer components.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 08:45 AM