mira-blender-scene
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill heavily relies on the
blender_execute_pythontool to automate Blender. It generates and executes Python scripts directly within the user's local Blender process. Evidence:SKILL.mddescribes the use ofblender_execute_pythonfor blocking out sets, placing lights, and animating. - [EXTERNAL_DOWNLOADS]: The skill uses tools to import generated 3D assets and reference video/image URLs from the Mira platform. Evidence:
blender_import_generationand references toreferenceVideoUrlsinSKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the Blender scene and user instructions to generate its execution logic, creating a surface for indirect injection. Evidence: Ingestion points include user prompts and scene data retrieved via
blender_get_sceneandblender_status. Capability inventory includes Python execution (blender_execute_python) and data upload (blender_playblast). It relies on procedural 'Doctrine' rules for safety rather than explicit input sanitization.
Audit Metadata