The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script tools/unimate.py clones an untrusted, third-party repository (https://github.com/Friedrich-M/UniMate) and installs it into a local virtual environment. This external code is subsequently executed to perform motion generation tasks, posing a significant risk of remote code execution from an unverified source.
[DYNAMIC_EXECUTION]: The utility tools/verify_blender.py uses the exec() function to execute Python code blocks that are dynamically extracted via regular expressions from the skill's markdown documentation files (references/validation-checklist.md and references/characters.md). This practice allows for arbitrary code execution if the local documentation files are modified.
[COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run and os.system within its internal tools (tools/unimate.py, tools/fidelity_check.py, tools/verify_blender.py) to execute shell commands. These commands are used to pilot Blender, manage Python environments, and run external CLI utilities like gltf-transform and gltfpack.
[EXTERNAL_DOWNLOADS]: The skill downloads code and data from several external sources, including 3D model marketplaces (PolyHaven, Sketchfab), Hugging Face Spaces for AI generation, and GitHub (Tencent and third-party repositories). While downloads from well-known services like Tencent or Hugging Face are common, the combination with untrusted third-party code increases the risk profile.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from multiple sources, including user-provided "briefs" and "reference images," as well as metadata from marketplace search results and outputs from AI generation services. This ingested data influences complex Blender operations and script execution, presenting an attack surface for indirect prompt injection.
Ingestion points: User briefs and image analysis (SKILL.md), marketplace metadata (sourcing-strategy.md), and AI-generated content (ai-generation.md).
Boundary markers: The instructions do not define clear boundary markers or "ignore" warnings when interpolating external content into prompts.
Capability inventory: The skill possesses significant capabilities, including full Blender API access (execute_blender_code), file system operations, and shell command execution.
Sanitization: There is no evidence of robust sanitization or validation of external data before it is used to drive automated modeling and animation logic.

kiln