blender-to-unity
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
mcp__blender__execute_blender_codeto run Python scripts within Blender for exporting models andexecute_codeto run C# scripts in Unity for post-import adjustments. This is the primary mechanism for the skill's automation. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it retrieves data from the Blender environment (such as object names and material properties) and uses them to construct C# scripts executed in the Unity editor.
- Ingestion points: Object and material names are retrieved from Blender via
mcp__blender__get_scene_infoand specialized Python scripts. - Boundary markers: No specific boundary markers are used to isolate untrusted data when generating scripts.
- Capability inventory: The skill utilizes tool execution capabilities (
execute_blender_code,execute_code) and file system access provided by the platform. - Sanitization: The instructions do not specify sanitization or escaping for Blender-sourced strings before they are interpolated into C# command templates like
GameObject.Find(\"<asset name>\").
Audit Metadata