blender-mesh

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The add_modifier.py script employs setattr to dynamically configure properties on Blender modifier objects.
  • Evidence: Found in scripts/add_modifier.py where the properties dictionary is iterated to update the modifier instance.
  • Context: The implementation includes safety checks using hasattr to ensure that only valid attributes belonging to the specific Blender modifier are modified, preventing arbitrary attribute injection.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data such as object names and modifier names which could originate from untrusted Blender scene files.
  • Ingestion points: The object_name and modifier_name parameters in all scripts within the scripts/ directory.
  • Boundary markers: No explicit delimiters or warnings are used when processing these strings.
  • Capability inventory: The skill is limited to modifying internal Blender scene data via the bpy module; it lacks capabilities for network communication, local file system writes, or subprocess execution.
  • Sanitization: Inputs are used as keys for lookups in Blender's data collections (bpy.data.objects.get), which provides inherent validation against the current scene context.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 03:25 PM