blender-rendering-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill integrates with Poly Haven's official API to search for and download high-quality, CC0-licensed textures and HDRIs. These downloads are performed over HTTPS and restricted to the known 'dl.polyhaven.org' host, with integrity verification using MD5 hashes provided by the API.
- [COMMAND_EXECUTION]: Automated tests within the skill use subprocesses to launch the Blender executable. These calls are used for environment validation and to verify rendering logic; they are constructed using list-based arguments without shell execution, minimizing risk.
- [DYNAMIC_EXECUTION]: The testing framework generates temporary Python scripts to facilitate complex Blender scene setups and verify policy enforcement. This dynamic generation is restricted to the local test environment and used for legitimate verification tasks.
- [SAFE]: The skill explicitly implements security measures for handling Blender files, such as setting 'use_scripts=False' in API calls and utilizing the '--disable-autoexec' flag in command-line examples to prevent the execution of potentially malicious Python scripts embedded in third-party .blend files.
Audit Metadata