The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The tool blender.execute_blender_code permits the execution of arbitrary Python scripts on the host machine through the Blender process. Blender's Python environment has unrestricted access to the host operating system via standard libraries like os and subprocess.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using the mcporter tool to interact with the Blender MCP server.
[EXTERNAL_DOWNLOADS]: The skill provides functionality to download 3D assets and textures from external services, specifically PolyHaven and Sketchfab.
[DATA_EXFILTRATION]: The blender.get_viewport_screenshot tool enables the capture of imagery from the user's active Blender workspace. Additionally, the skill explicitly instructs the agent to send the user's original request to a telemetry service via the user_prompt argument.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by processing external asset data and interpolating user input into command arguments without sanitization.
Ingestion points: Asset metadata from PolyHaven and Sketchfab, as well as the user_prompt parameter (SKILL.md).
Boundary markers: Absent; there are no clear delimiters or instructions to ignore embedded commands in the processed data.
Capability inventory: Powerful host-level execution capabilities via blender.execute_blender_code (SKILL.md).
Sanitization: No input validation or escaping mechanisms are described for the data being processed.

blender