blender-sculpting
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill implements a
final_renderfunction inbx_sculpt.pythat utilizes Blender's rendering engine (bpy.ops.render.render) to write image files to the local filesystem. While this is an intended feature for saving work, it provides a mechanism for file creation on the host system.\n- [INDIRECT_PROMPT_INJECTION]: TheSculptorclass inbx_sculpt.pyingests external mesh data using Blender's API. This creates a surface where geometric data is processed by the agent, which could theoretically be used to influence agent behavior if not properly delimited, although the risk is low for this specific use case.\n- [SAFE]: Absolute file paths pointing to the author's local directory (/Users/emmanuel/Developer/pro/2026-09-24 Blender Expert Skills/) are included in documentation and code comments. These represent environment-specific references used for testing and do not pose a direct security threat to the end user.
Audit Metadata