The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to interpolate user-provided strings (such as object names) directly into Python code snippets that are subsequently executed in the Blender environment. There is a lack of explicit sanitization or validation instructions for these inputs, creating a surface for potential command injection if a malicious user provides an object name containing Python escape characters (e.g., quotes and semicolons).
Ingestion points: User-provided object names within the chat query (e.g., 'apply material to [object name]').
Boundary markers: None present; the instructions suggest direct replacement of placeholder strings like 'GEO-target'.
Capability inventory: The skill uses mcp__blender__execute_blender_code, which allows for arbitrary Python execution within the Blender process.
Sanitization: Absent; there are no instructions for the agent to escape or validate the user-supplied strings before interpolation.
[DYNAMIC_EXECUTION]: The skill facilitates the generation and execution of Python scripts at runtime to modify the Blender scene state. While this is the primary intended function of the skill, it relies on template-based code generation that incorporates external variables.

blender-materials