The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The reference file reference/ADVANCED_SHADER_NODES.md includes multiple Python code examples that use the requests library to send executable code blocks to a remote endpoint (requests.post(url, json={"code": code})). The url variable is not defined within the scope of these examples, creating a risk where the execution destination could be hijacked or directed to an untrusted server.- [EXTERNAL_DOWNLOADS]: The skill documentation references the use of the requests library for network-based tool communication. Although the SKILL.md history log indicates these were removed in a newer version, the presence of these patterns in the v1.0.0 reference files (e.g., reference/ADVANCED_SHADER_NODES.md) suggests a maintenance oversight that could be exploited.- [DYNAMIC_EXECUTION]: Many examples in the reference documentation involve the creation of multi-line Python strings representing Blender operations which are then passed to execution wrappers. This pattern of dynamic code generation and execution is sensitive, especially when linked to the previously mentioned network transmission patterns.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to respond to specific user keywords and potentially interpolate user requirements into generated Blender Python scripts. It lacks explicit input sanitization or boundary markers to prevent the agent from executing malicious Blender API calls if untrusted instructions are embedded within a user material description or texture request.

blender-materials-shaders