skills/impertio-studio/blender-bonsai-ifcopenshell-sverchok-claude-skill-package/blender-syntax-materials/Gen Agent Trust Hub
blender-syntax-materials
Warn
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: MEDIUMPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill's metadata contains deceptive authorship information. The SKILL.md frontmatter identifies the author as 'OpenAEC-Foundation', which does not match the known author 'Impertio-Studio' or its established naming patterns. This misleading metadata can lead to incorrect trust assessments by users or agents.- [PROMPT_INJECTION]: The skill provides patterns that process untrusted external data, creating a surface for indirect prompt injection.
- Ingestion points: The skill accepts external file paths through variables like 'texture_dir' in Example 2 (references/examples.md) and reads attributes from active Blender objects.
- Boundary markers: No delimiters or explicit instructions are provided to the agent to treat processed data as untrusted or to ignore embedded commands.
- Capability inventory: The skill utilizes the 'bpy' API and 'os' module to perform file system operations (bpy.data.images.load) and manipulate the Blender scene and object data.
- Sanitization: The provided code patterns do not include logic for sanitizing, validating, or escaping input paths or mesh data content before use.
Audit Metadata