blender
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use various shell commands for routine operations, such as
blender -bfor headless rendering,uvfor managing the execution environment,git clonefor documentation access, anddifffor verifying add-on installations. - [DYNAMIC_EXECUTION]: It details the usage of an
execute_blender_codetool which performs dynamic execution (exec) within the Blender process. The instructions specifically guide the agent to treat this as a last resort and favor safer, structured API tools whenever possible. - [EXTERNAL_DOWNLOADS]: The skill references the official Blender Foundation forge at
projects.blender.orgfor cloning the project wiki and accessing the Gitea API to check releases and issues. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it processes complex external data including
.blendscene files and.rstdocumentation. It mitigates logic errors by mandating visual verification of rendered output to confirm the state reported by scene measurements. - [DATA_EXFILTRATION]: It describes methods for handling large data payloads by writing JSON files to the local temporary directory (
bpy.app.tempdir) and reading them via the shell to bypass socket communication limits.
Audit Metadata