worldlabs
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
worldlabsCLI andcurlto manage API requests and file uploads. These actions are aligned with the skill's purpose of enabling 3D scene estimation and image generation tasks. - [EXTERNAL_DOWNLOADS]: The skill instructs the installation of
@worldlabsai/cli@0.1.0via npm. This package is an official resource from the author (worldlabsai). - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided images and text prompts via CLI tools, representing a data ingestion surface. 1. Ingestion points: Local files (
photo.jpg) and text prompts for tasks like image generation. 2. Boundary markers: No specific delimiters are defined in the instructions for separating user data. 3. Capability inventory: Includes reading local files, writing task outputs to disk, network access to vendor endpoints, and subprocess execution for the CLI. 4. Sanitization: Not explicitly documented; functionality relies on the vendor-provided CLI implementation.
Audit Metadata