model3d-gen
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npx @gltf-transform/clifor asset validation, which involves fetching and executing code from the npm registry at runtime. This is a common method for accessing specialized 3D validation utilities. - [COMMAND_EXECUTION]: The instructions provide shell command templates for running Blender in headless mode and using CLI-based inspection tools. These operations are essential for the 3D asset pipeline described in the skill.
- [PROMPT_INJECTION]: The skill processes user-provided asset specifications, which represents an indirect prompt injection surface.
- Ingestion points: The 'Asset Spec' section in
SKILL.mddefines several fields (name, subject, output_path) provided by the user. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are provided for these fields.
- Capability inventory: The skill utilizes shell commands for Blender and npx tools.
- Sanitization: No specific sanitization or validation logic for the input strings is described before they are incorporated into commands or file operations.
Audit Metadata