The Agent Skills Directory

[METADATA_POISONING]: The SKILL.md file attributes the skill to 'arjun988' via a GitHub link, which conflicts with the provided author context of 'proyecto26'. This discrepancy is deceptive and could mislead users or auditors about the skill's origin.
[INDIRECT_PROMPT_INJECTION]: The scripts/light_rig.py script ingests external data through command-line arguments and JSON files. This creates a vulnerability surface where maliciously crafted input could influence the agent's behavior within the Blender environment.
Ingestion points: The script processes data from sys.argv and files provided via the --args-file flag in the _cli_args function.
Boundary markers: There are no explicit instructions or delimiters in the prompt to prevent the agent from obeying instructions embedded within the lighting parameters.
Capability inventory: The script has the capability to create, name, and delete Blender objects and lights, as well as modify global world and view settings.
Sanitization: While the script validates preset names, it lacks comprehensive sanitization for other input values, potentially allowing for unexpected scene manipulations.
[COMMAND_EXECUTION]: The skill executes a local Python script (scripts/light_rig.py) using runpy.run_path. While the script performs legitimate Blender API operations, this execution model allows the agent to run code that interacts directly with the host's Blender environment and file system.

lighting