The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill generates Python scripts for Blender at runtime by interpolating configuration variables (such as asset_name and input_file) into a code template (generate_blender_pipeline_script in references/game-pipeline.md). These generated scripts are subsequently executed via a subprocess call to Blender. The direct interpolation of metadata into executable code without visible sanitization creates a risk of code injection within the Blender process.
[DATA_EXFILTRATION]: The skill performs network operations using the httpx library to communicate with various third-party 3D generation APIs, including Meshy, Tripo, and Rodin. These operations involve uploading data and polling for results from domains outside the whitelisted list, representing a data exfiltration surface if sensitive information were included in the payloads.
[INDIRECT_PROMPT_INJECTION]: The skill's workflow involves ingesting and processing untrusted data from user prompts and external assets (such as images and model URLs). It lacks explicit delimiters or boundary markers to distinguish between instructions and data, making it susceptible to indirect prompt injection where malicious content in an asset could override the agent's behavior during the generation or validation phases.

clay