blender-sculpting

Pass

Audited by Gen Agent Trust Hub on Aug 23, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill generates Python code in strings and executes them using the execute_blender_code tool. This is the core mechanism for automation but represents a dynamic code execution surface.- [EXTERNAL_DOWNLOADS]: Reference files reference/ADVANCED_SCULPTING.md and reference/TERRAIN_GENERATION.md include import requests, which provides the capability for network operations, although no specific malicious URLs are targeted.- [INDIRECT_PROMPT_INJECTION]: The skill ingests heightmap images without sanitization or boundary markers, using them to drive vertex displacement.
  • Ingestion point: bpy.data.images.load in reference/TERRAIN_GENERATION.md.
  • Boundary markers: Absent; no instructions are provided to the agent to treat external asset data as untrusted.
  • Capability inventory: The skill has access to the execute_blender_code tool for Python execution and performs file system writes via image.save().
  • Sanitization: Absent; pixel data from external files is directly used to modify mesh geometry coordinates.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 23, 2026, 07:31 AM