blender-scene-assembly
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate functionality for Blender scene management. It uses thin Python wrappers to call methods from the vendor's own packages (dcc_mcp_core and dcc_mcp_blender). No suspicious network activity, credential handling, or code obfuscation was identified.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts external file paths which could potentially lead to indirect prompt injection if an agent processes instructions embedded in a malicious .blend file.
- Ingestion points: The filepath parameter in tools defined in tools.yaml, such as merge_scene, append_from_blend, and link_from_blend, allows the ingestion of external data.
- Boundary markers: Absent; no specific markers or instructions are provided to the agent to disregard content within the external files.
- Capability inventory: The skill has the capability to mutate the active Blender scene, create and delete data blocks, and manage library references.
- Sanitization: No sanitization of the binary content within the .blend files is performed in the entry point scripts.
Audit Metadata