The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to translate user-provided "text briefs" and reference images into 3D scenes via Blender's Python API. This creates a vulnerability surface where a malicious brief could contain instructions intended to bypass safety guardrails or perform unauthorized actions through the agent's capabilities.
Ingestion points: Untrusted user input enters the agent context through the "brief" and "reference image" described in the build plan (SKILL.md, section 1).
Boundary markers: The instructions do not specify the use of strict delimiters or explicit "ignore embedded instructions" warnings when the agent restates the brief as a build plan.
Capability inventory: The agent has the ability to execute arbitrary Python code via the platform's execute_python tool. The provided scripts (bx_blockout.py) include capabilities for file system operations such as saving and backing up .blend files (bpy.ops.wm.save_as_mainfile).
Sanitization: There is no evidence of input validation or sanitization for the content extracted from the user's brief before it influences the generated build plan or Python execution.
[DYNAMIC_EXECUTION]: The skill uses dynamic module loading and path manipulation to manage its internal scripts within Blender's persistent Python environment. While typical for Blender automation, this pattern involves loading code from computed paths at runtime.
Evidence: The toolkit instructions in SKILL.md and bx_blockout.py specify inserting the skill's script directory into sys.path and manually removing modules from sys.modules to force re-imports. This dynamic loading of executable content is a common vector for code injection if the file paths are manipulated.

scenario-blender-blockout