blender-expressions

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill provides a set of tools to interface with Blender's internal driver and expression API. All operations, including the evaluation and creation of scripted expressions, are consistent with the skill's stated purpose of managing animation drivers.
  • [INDIRECT_PROMPT_INJECTION]: The skill handles expression strings that are executed within the Blender Python environment. While this is the intended functionality, it creates a surface where an agent could potentially be influenced by untrusted data (such as object descriptions or scene metadata) to create or execute malicious scripts. The risk is inherent to the domain of scriptable animation systems and not a defect in the skill itself.
  • Ingestion points: The expression property in add_driver and set_driver_expression tools.
  • Boundary markers: None present in the tool schemas to delimit user intent from data.
  • Capability inventory: Execution of Python expressions within the Blender process context.
  • Sanitization: Not observed in the provided wrapper scripts; logic is handled by the internal dcc_mcp_blender library.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 03:25 PM