blender-materials
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
mcp__blender__execute_blender_codetool to run dynamically generated Python scripts based on provided material recipes. This allows the agent to automate the creation of PBR shaders using thebpymodule. - [PROMPT_INJECTION]: The skill contains an indirect prompt injection attack surface because it interpolates untrusted user data into executable scripts.
- Ingestion points: The skill expects the agent to replace the
GEO-targetplaceholder with object names provided by the user in the prompt. - Boundary markers: There are no delimiters or warnings to ignore instructions embedded in the object names.
- Capability inventory: The skill has the capability to execute arbitrary Python code via
mcp__blender__execute_blender_codeand perform shell operations viaBash. - Sanitization: No sanitization or escaping logic is included to prevent object names from breaking out of string literals to execute arbitrary code.
- [EXTERNAL_DOWNLOADS]: The skill documentation includes a link to
physicallybased.info, which is a well-known service providing reference values for physically-based materials. This reference is used neutrally for look-development purposes.
Audit Metadata