The Agent Skills Directory

[DYNAMIC_EXECUTION]: Multiple scripts, including scripts/2d-to-3d.sh, scripts/generate-animation.sh, and scripts/queue-render.sh, use a pattern of dynamically generating Python scripts at runtime. These scripts are created by interpolating shell variables directly into Python source code within a 'here-document' block. Because variables such as $INPUT_FILE and $OUTPUT_FILE are not sanitized or escaped, a malicious actor could use a specially crafted file name to inject and execute arbitrary Python code within the Blender process context.
[COMMAND_EXECUTION]: The scripts/start-mcp-server.sh script implements a custom HTTP server designed for remote automation. This server accepts POST requests that trigger shell commands via subprocess.Popen. The implementation lacks any authentication or authorization mechanisms, meaning any process on the local machine (or the network, if configured) can trigger command execution on the host system.
[DATA_EXFILTRATION]: The file create-animation.py contains hardcoded absolute paths that reveal the original author's home directory (/home/ae/AE/.claude/skills/blender-3d-studio/). This constitutes a leak of internal environment metadata and directory structures.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of file paths and external configuration data without adequate validation or sanitization. This provides a surface for indirect injection attacks that could exploit the aforementioned dynamic code execution vulnerabilities.
Ingestion points: File paths passed to scripts via --input or --output arguments.
Boundary markers: Absent; inputs are interpolated directly into code blocks.
Capability inventory: File system writing (script generation) and subprocess execution (Blender and Python).
Sanitization: No input validation or escaping logic is present for user-supplied paths.

Blender 3D Animation Studio