blender-product-polish
Fail
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/blender-product-polish.jsis vulnerable to command injection via the--fileparameter. The script constructs a Python command string by interpolating thepyPathvariable:bpy.ops.import_scene.gltf(filepath="${pyPath}"). While it handles backslash escaping for Windows, it does not escape double quotes. A malicious file path such asfile.glb\"; <python_code>; #would break out of the string literal and execute the injected Python code within Blender. - [REMOTE_CODE_EXECUTION]: The skill sends dynamically generated Python instructions to an external process for execution. The
sendToBlenderfunction connects to a TCP socket onlocalhost:9876and transmits a JSON payload with anexecute_codetype containing the generated Python logic.
Recommendations
- AI detected serious security threats
Audit Metadata