blender-mcp-integration
Warn
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONINGEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill requires building a Rust-based analyzer (SceneIR) by executing bun run setup:runtime within the plugin root. It also uses the BAS_RUNTIME_EXECUTABLE environment variable to define and run a compiled binary for scene analysis functions.
- [REMOTE_CODE_EXECUTION]: Instructions recommend using third-party MCP servers from untrusted repositories (ahujasid/blender-mcp, sandraschi/blender-mcp). These implementations include remote host support and telemetry, introducing external network connections and unverifiable code execution paths.
- [METADATA_POISONING]: The astra-workflow.md file contains deceptive information referencing a fictional model version (gpt-6-astra) and a future date (2026-09-04). This appears designed to influence agent behavior, such as reducing clarification turns, based on non-existent future capabilities.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which creates an injection surface.
- Ingestion points: External assets (Mixamo, Pixabay, Poly Haven) and user-supplied .blend scenes.
- Boundary markers: None identified for isolating asset content from control instructions.
- Capability inventory: Subprocess execution via Rust runtime; Python execution via Blender MCP tools; network downloads.
- Sanitization: No validation or sanitization mechanisms are described for ingested assets or scene metadata.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the discovery and retrieval of assets from well-known services such as Mixamo and Pixabay for use in animation and sound design workflows.
Audit Metadata