blender-sculpting
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates Python code in strings and executes them using the
execute_blender_codetool. This is the core mechanism for automation but represents a dynamic code execution surface.- [EXTERNAL_DOWNLOADS]: Reference filesreference/ADVANCED_SCULPTING.mdandreference/TERRAIN_GENERATION.mdincludeimport requests, which provides the capability for network operations, although no specific malicious URLs are targeted.- [INDIRECT_PROMPT_INJECTION]: The skill ingests heightmap images without sanitization or boundary markers, using them to drive vertex displacement. - Ingestion point:
bpy.data.images.loadinreference/TERRAIN_GENERATION.md. - Boundary markers: Absent; no instructions are provided to the agent to treat external asset data as untrusted.
- Capability inventory: The skill has access to the
execute_blender_codetool for Python execution and performs file system writes viaimage.save(). - Sanitization: Absent; pixel data from external files is directly used to modify mesh geometry coordinates.
Audit Metadata