blender-geometry-nodes
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the 'Bash' tool to execute Python scripts that interact with the Blender 'bpy' API. This is the intended mechanism for controlling Blender through the MCP framework. The commands are restricted to running localized scripts within the skill's directory.
- [DATA_EXPOSURE]: The skill retrieves information about Blender's internal state (node counts, links, socket names, and modifier properties). This information is returned to the user context as intended for procedural modeling workflows and does not expose sensitive system credentials or files.
- [PRIVILEGE_ESCALATION]: All operations are performed within the user's Blender session. There are no attempts to acquire administrative privileges or bypass operating system security controls.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided strings for object names, group names, and socket labels. While these are interpolated into internal Blender queries, the tool uses standard schema validation (e.g., max length 63 bytes for names) and specific Blender API calls rather than raw shell execution of user input, minimizing the risk of injection affecting the underlying host system.
- [SAFE]: The external dependencies and imported modules (dcc_mcp_core, dcc_mcp_blender) are internal vendor resources associated with the skill's author ('dcc-mcp'). No suspicious third-party downloads or remote code execution patterns were identified.
Audit Metadata