The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/polyhaven-hdri-showcase.js dynamically assembles Python code blocks that are sent to a local Blender MCP server for execution.
[REMOTE_CODE_EXECUTION]: Input parameters such as --hdris and --output are interpolated directly into Python string literals within template strings. Specifically, the variable hdriId and the derived renderPath are placed inside double quotes in the generated Python code. An attacker or a malicious prompt could provide input containing double quotes and Python commands (e.g., "; import os; os.system('payload'); #") to break out of the string context and execute arbitrary code with the privileges of the Blender process.
[COMMAND_EXECUTION]: The script establishes an unauthenticated network connection to localhost on a user-definable port (default 9876) to transmit these executable payloads, providing a direct path for local code execution.

polyhaven-hdri-showcase