blender-procedural-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, creating a potential attack surface for instructions embedded in retrieved content.
- Ingestion points: The skill retrieves reference images and visual data using browser tools and host image search as described in
references/astra-workflow.mdto guide modeling decisions. - Boundary markers: No explicit boundary markers or instructions to treat external data as untrusted are present in the guidelines.
- Capability inventory: The skill has high capability, including generating Python scripts, writing files, and invoking platform-specific Blender validation and rendering tools.
- Sanitization: There is no evidence of sanitization or filtering for data retrieved from external sources before it is processed or used to influence script generation.
- [EXTERNAL_DOWNLOADS]: The skill references and downloads content from external web locations.
- Fetches 3D materials and assets from Poly Haven, a well-known community resource for high-quality assets.
- References official technical documentation from OpenAI's developer guides.
- [DYNAMIC_EXECUTION]: The skill's primary operation involves the automated generation and execution of procedural logic.
- Generates Python source code to drive Blender's internal modeling engine and Geometry Nodes systems as specified in
SKILL.md. - Instructions encourage the creation of durable, reproducible scripts for scene assembly.
Audit Metadata