blender-mesh
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The
add_modifier.pyscript employssetattrto dynamically configure properties on Blender modifier objects. - Evidence: Found in
scripts/add_modifier.pywhere thepropertiesdictionary is iterated to update the modifier instance. - Context: The implementation includes safety checks using
hasattrto ensure that only valid attributes belonging to the specific Blender modifier are modified, preventing arbitrary attribute injection. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data such as object names and modifier names which could originate from untrusted Blender scene files.
- Ingestion points: The
object_nameandmodifier_nameparameters in all scripts within thescripts/directory. - Boundary markers: No explicit delimiters or warnings are used when processing these strings.
- Capability inventory: The skill is limited to modifying internal Blender scene data via the
bpymodule; it lacks capabilities for network communication, local file system writes, or subprocess execution. - Sanitization: Inputs are used as keys for lookups in Blender's data collections (
bpy.data.objects.get), which provides inherent validation against the current scene context.
Audit Metadata