blender-superskill

This is a Blender workflow orchestrator that persists state and invokes the Codex CLI in full-auto mode; the primary security concerns are the powerful external worker invocation, unrestricted extra CLI arguments, and path handling. A crafted run name combined with --force could resolve outside the run root and recursively delete an unintended directory, depending on the supplied path and platform. Task and reference text can also influence the AI worker via prompt injection. No embedded credential theft, covert network activity, or other clear malware indicators are present; severity is moderate due to execution and deletion risks.