uv-clean-atlas
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches model weights from Hugging Face and installs dependencies from PyPI and Conda registries. These are well-known services used for their intended purposes within the 3D and AI development workflow.
- [COMMAND_EXECUTION]: The pipeline utilizes shell commands to invoke Blender in headless mode and includes a shell script for environment installation. Additionally, internal scripts utilize subprocess execution for projection tasks as flagged by static analysis. These operations are restricted to the local environment and are necessary for the skill's primary functionality.
- [REMOTE_CODE_EXECUTION]: The installation script (scripts/partuv_install.sh) automates the setup of the PartUV research tool, which involves downloading code and checkpoints from external repositories (GitHub and Hugging Face) and executing them locally.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external 3D mesh files (.blend, .obj) and decimated 'rips'. While these serve as ingestion points for untrusted data, the processing is limited to geometric analysis and UV unwrapping, with several built-in safety checks for mesh health (e.g., weld/degenerate face checks).
Audit Metadata