blender-forest
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The script
scripts/gen_sfx.pycommunicates with the ElevenLabs API (api.elevenlabs.io) to generate sound effects. This operation uses a user-provided API key from environment variables and transmits only text prompts for audio synthesis. ElevenLabs is recognized as a well-known service.- [COMMAND_EXECUTION]: The skill automates complex 3D modeling and rendering tasks using the Blender Python API. Several scripts (scripts/bench.py,scripts/scatter.py, etc.) usectypesto lower the process priority of Blender on Windows. This is a legitimate performance management technique used to maintain system responsiveness during high-compute rendering operations.- [DYNAMIC_EXECUTION]: PowerShell scripts such asscripts/screen_guard.ps1andscripts/stay_awake_encode.ps1interface with the Windows API to manage system power states. Specifically, they prevent the PC from sleeping during renders and programmatically turn off the monitor when the system is idle. These actions are consistent with the skill's purpose of managing long-running background tasks.- [EXTERNAL_DOWNLOADS]: The skill workflow includes downloading assets from third-party tutorials. It enforces a security policy requiring the agent to perform virus scans and file-level audits (checking for embedded scripts or drivers in.blendfiles) before integrating them into the project. Thescripts/audit_blend.pyscript is provided to facilitate this inspection.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest YouTube transcripts and analyze video frames. While this introduces an attack surface for untrusted external data, the skill mitigates risk by focusing on technical 3D construction parameters and maintaining strict boundaries for code generation, as outlined in theSKILL.mdinstructions.
Audit Metadata