blender-car-film

Warn

Audited by Socket on Nov 1, 2026

1 alert found:

Security
SecurityMEDIUM
tools/bridge.py

This code provides an unauthenticated arbitrary-Python execution bridge inside Blender at 127[.]0[.]0[.]1:9876. Its loopback binding limits exposure to local clients, but any process that can connect can execute code with Blender's privileges; the unbounded synchronous receive loop also permits local denial of service. This is a severe security risk if enabled where untrusted local processes can connect, though the explicit bridge behavior alone does not establish malicious intent.

Confidence: 99%Severity: 82%
Audit Metadata
Analyzed At
Nov 1, 2026, 04:51 PM
Package URL
pkg:socket/skills-sh/mromidev%2Fclaude-blender-skills%2Fblender-car-film%2F@7f56f4785cf3b79470ae5392474bea9392d8f23f1015dfac2c1f32f5df0f5228