blender-3d
Warn
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides a helper function 'bake_and_replace_driver' that uses the 'exec()' function to dynamically assign values to object properties during animation baking.
- Evidence: The line 'exec(f"target.{data_path} = {values[i]}")' in 'SKILL.md'.
- Risk: Executing dynamically generated strings is a common code injection vector. If the 'data_path' or the resolved values are influenced by untrusted external data, it could lead to arbitrary code execution within the Blender process.
- [COMMAND_EXECUTION]: The skill instructs the agent to use shell commands to communicate with a local Blender instance.
- Evidence: The use of 'curl -s localhost:5656 --data-binary @- <<'PYEOF'' in 'SKILL.md'.
- Context: While the target is 'localhost', directing the agent to execute shell commands for API interaction increases the attack surface and allows for potential command manipulation.
Audit Metadata