skills/zkmake/skills/model-pass/Gen Agent Trust Hub

model-pass

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes local shell scripts to automate 3D rendering audits and image comparisons, which are essential for its stated purpose.
  • scripts/shot.sh invokes the agent-browser tool to capture screenshots of the 3D studio, setting specific browser flags like --disable-gpu-vsync and --disable-frame-rate-limit to ensure stable headless rendering.
  • scripts/compare.sh employs the magick (ImageMagick) utility to perform image montages and pixel-level comparisons (magick compare -fuzz 3%) to verify that model changes do not introduce unintended visual regressions.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for processing 3D model data, which acts as an ingestion surface for potentially untrusted external content.
  • Ingestion points: The skill processes 3D model files (geometries, materials) and project-specific configuration files like 3D-STYLE.md to perform its audits.
  • Boundary markers: While the skill uses specific studio helpers to delimit measurements, it lacks explicit prompt-level delimiters for data extracted from model metadata.
  • Capability inventory: The agent is granted capabilities for browser interaction, screenshot capture, and local command execution related to image processing.
  • Sanitization: The audit process includes geometric validation via assets/studio-helpers.ts, which checks for non-finite values (NaN) and zero-length normals to prevent rendering artifacts and bloom-related 'black frame' issues.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 10:42 AM