skills/zapabob/skills/blender-cad/Gen Agent Trust Hub

blender-cad

Pass

Audited by Gen Agent Trust Hub on Jun 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill requests the bash tool and lists blender, python, and git as required CLI tools. It generates and executes local Python scripts to automate modeling workflows within the Blender environment.
  • [EXTERNAL_DOWNLOADS]: The instructions include a reference to a GitHub repository (github.com/visiblink/cad-transforms) for a CAD transformation extension. This is presented as a documentation resource for the user.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of untrusted external CAD files alongside powerful script-writing and shell-execution capabilities. Ingestion points: The skill reads STEP and IGES files from the blender-project/source/ directory for processing. Boundary markers: Absent; the instructions do not specify any delimiters or safety prompts to prevent the agent from following instructions embedded in the data files. Capability inventory: The agent can write files, execute shell commands via bash, and run arbitrary Python code via the blender_run_script tool. Sanitization: No validation or sanitization mechanisms are described for the content extracted from external CAD models before it is used in automation logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 23, 2026, 06:39 AM