blender-render-and-export

Pass

Audited by Gen Agent Trust Hub on Nov 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The instructions in SKILL.md direct the agent to dynamically construct a Python script at runtime by prepending a configuration dictionary to the source code of the helper script.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Blender scenes (such as object and camera names) and user-provided strings for path construction, which could potentially be used to influence agent behavior.
  • Ingestion points: parameters like camera_name, object_names, and output_path in scripts/render_or_export.py and scripts/inspect_roundtrip.py.
  • Boundary markers: The skill relies on structured JSON communication but does not use explicit delimiters to isolate untrusted scene data from instructions.
  • Capability inventory: The skill has the ability to write files to the filesystem, create directories, and perform scene-destructive operations within the Blender environment.
  • Sanitization: The scripts implement strong defensive measures, including enforcing absolute paths, whitelisting file extensions (e.g., .png, .glb, .usd), and refusing to overwrite existing files.
  • [COMMAND_EXECUTION]: The skill executes the Blender binary with specific flags and custom Python scripts to perform file processing and rendering tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 14, 2026, 08:13 AM