operators
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references example scripts and documentation hosted on external platforms, including the author's GitHub repository (
github.com/TMHSDigital) and the official Blender documentation. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest user-specified parameters to generate executable Python code for the Blender environment, which introduces a surface for indirect instructions.
- Ingestion points: User-provided inputs for "Action category", "Operator name", and "Class name" are used to construct the operator class and its metadata within the generated script.
- Boundary markers: No specific delimiters or instructions to ignore embedded content are provided for the user-supplied strings during the interpolation process.
- Capability inventory: The generated code has the capability to modify mesh data, access scene objects, and interact with the
bpyAPI, which could be misused if malicious instructions are injected into the metadata strings. - Sanitization: The skill provides documentation for defensive context handling and validation patterns to be used within the generated code to reduce runtime errors and unintended behavior.
Audit Metadata