blender-forest

Pass

Audited by Gen Agent Trust Hub on Nov 1, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXFILTRATION]: The script scripts/gen_sfx.py communicates with the ElevenLabs API (api.elevenlabs.io) to generate sound effects. This operation uses a user-provided API key from environment variables and transmits only text prompts for audio synthesis. ElevenLabs is recognized as a well-known service.- [COMMAND_EXECUTION]: The skill automates complex 3D modeling and rendering tasks using the Blender Python API. Several scripts (scripts/bench.py, scripts/scatter.py, etc.) use ctypes to lower the process priority of Blender on Windows. This is a legitimate performance management technique used to maintain system responsiveness during high-compute rendering operations.- [DYNAMIC_EXECUTION]: PowerShell scripts such as scripts/screen_guard.ps1 and scripts/stay_awake_encode.ps1 interface with the Windows API to manage system power states. Specifically, they prevent the PC from sleeping during renders and programmatically turn off the monitor when the system is idle. These actions are consistent with the skill's purpose of managing long-running background tasks.- [EXTERNAL_DOWNLOADS]: The skill workflow includes downloading assets from third-party tutorials. It enforces a security policy requiring the agent to perform virus scans and file-level audits (checking for embedded scripts or drivers in .blend files) before integrating them into the project. The scripts/audit_blend.py script is provided to facilitate this inspection.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest YouTube transcripts and analyze video frames. While this introduces an attack surface for untrusted external data, the skill mitigates risk by focusing on technical 3D construction parameters and maintaining strict boundaries for code generation, as outlined in the SKILL.md instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 1, 2026, 04:54 PM