text-to-blender

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill generates Python code snippets to manipulate the Blender environment, such as the reset_world function and viewport shading configurations. These snippets are executed via the mcp__blender__execute_blender_code tool. This is the core intended functionality of the skill for 3D automation and is managed through structured naming conventions and safe templates.
  • [INDIRECT_PROMPT_INJECTION]: The orchestrator possesses an attack surface for indirect prompt injection as it processes natural language requests and incorporates visual feedback from viewport screenshots to iterate on code generation. It includes a quality-refinement-autoloop sub-skill that can update instructions or documentation based on session history.
  • Ingestion points: User-provided requests, wireframe drawings (wireframe-to-3d), and visual validation results from mcp__blender__get_viewport_screenshot in SKILL.md.
  • Boundary markers: The skill instructs the agent to identify intent and route to sub-skills, but does not specify explicit delimiters for external data within the orchestration logic.
  • Capability inventory: The skill has broad capabilities within the Blender environment via mcp__blender__execute_blender_code and file system management through Bash tools.
  • Sanitization: The refinement logic is described as producing "sanitized reusable lessons" and requires explicit user requests before patching documentation.
  • [EXTERNAL_DOWNLOADS]: The skill documentation in references/common-object-dimensions.md suggests importing assets from established industry platforms such as Polyhaven and Sketchfab, or generating them via Hyper3D. These are standard resources for 3D content and are used to supplement the skill's procedural generation.
  • [COMMAND_EXECUTION]: The skill uses standard shell tools (Bash, Grep, Glob) to perform operations like verifying the existence of rendered output files (e.g., using ls -la /path/to/output). This usage is consistent with managing a local 3D production pipeline.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 11:24 AM