ovrtx-hero-render
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
blendercommand-line interface to execute a specific Python script located atskills/blender-render-and-export/scripts/render_or_export.py. This is a standard automation pattern for Blender-based workflows. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-owned Blender files (
.blend), which are complex binary formats that can contain embedded scripts or drivers. While required for the skill's functionality, this ingestion of untrusted data represents an attack surface. - Ingestion points: User-supplied scene file at
/absolute/caller-owned/hero.blend. - Boundary markers: None identified in the prompt instructions to isolate user content from the rendering logic.
- Capability inventory: Execution of the
blenderbinary with background processing and script execution capabilities. - Sanitization: None; the skill relies on the caller-owned file being safe for rendering.
Audit Metadata