The Agent Skills Directory

[SAFE]: The skill implements professional rigging workflows based on recognized industry experts (CGDive, Demeter Dzadik, Rik Schutte). Analysis of the code and instructions shows consistent application of these practices.
[COMMAND_EXECUTION]: The script scripts/bx_rig.py uses subprocess.run in the cycle_check function. This is used to launch a headless instance of Blender (blender -b --factory-startup) to validate dependency cycles without crashing the main process. It uses the local Blender binary path and a static Python expression, which is a standard and safe practice for technical validation in 3D pipelines.
[INDIRECT_PROMPT_INJECTION]: The skill ingests mesh data from the Blender environment and has capabilities for file writing (PNG sheets/logs) and running the Blender process headlessly. These are necessary for its primary purpose of rigging and verification. The attack surface is minimal and specialized for 3D data processing, presenting no meaningful security risk.
[DATA_EXPOSURE]: Documentation and comments contain local path references (e.g., /Users/emmanuel/...) used during the author's development and testing. These are static strings used for context and do not involve credential exposure or active exfiltration.
[REMOTE_CODE_EXECUTION]: The skill references local sibling directories (e.g., blender-sculpting, blender-expert) for extended functionality. These are local file system imports of trusted components within the same project environment and do not involve remote downloads or untrusted code execution.

blender-rigging