blender-render-and-export
Pass
Audited by Gen Agent Trust Hub on Nov 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The instructions in SKILL.md direct the agent to dynamically construct a Python script at runtime by prepending a configuration dictionary to the source code of the helper script.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Blender scenes (such as object and camera names) and user-provided strings for path construction, which could potentially be used to influence agent behavior.
- Ingestion points: parameters like
camera_name,object_names, andoutput_pathinscripts/render_or_export.pyandscripts/inspect_roundtrip.py. - Boundary markers: The skill relies on structured JSON communication but does not use explicit delimiters to isolate untrusted scene data from instructions.
- Capability inventory: The skill has the ability to write files to the filesystem, create directories, and perform scene-destructive operations within the Blender environment.
- Sanitization: The scripts implement strong defensive measures, including enforcing absolute paths, whitelisting file extensions (e.g., .png, .glb, .usd), and refusing to overwrite existing files.
- [COMMAND_EXECUTION]: The skill executes the Blender binary with specific flags and custom Python scripts to perform file processing and rendering tasks.
Audit Metadata