The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external FBX and DAE files to extract skeletal data. Maliciously named bones in these files could potentially serve as indirect prompt injections if the agent displays them to the user or processes them as instructions without further isolation.\n
Ingestion points: addon/commands/import_.py (imports FBX and DAE files).\n
Boundary markers: None explicitly defined for displayed bone names.\n
Capability inventory: The skill has access to Bash, Write, and Read tools, and performs complex file operations in Blender.\n
Sanitization: addon/utils/bone_matching.py sanitizes bone names by removing non-alphanumeric characters, which mitigates simple injection payloads but does not eliminate the risk for the LLM.\n- [COMMAND_EXECUTION]: The CLI utility spawns local Blender processes to install and build the addon components (scripts/src/cli/commands/daemon.ts). These actions are transparent and necessary for the intended functionality.\n- [EXTERNAL_DOWNLOADS]: The documentation and helper scripts facilitate the manual download of animation files from Mixamo.com by the user. No automated remote code downloads or executions from untrusted sources were detected.

blender-toolkit