skills/zapabob/skills/blender-mcp/Gen Agent Trust Hub

blender-mcp

Fail

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions include a command to download a Python script (addon.py) from an external repository (raw.githubusercontent.com/ahujasid/blender-mcp/main/addon.py). The source repository belongs to an untrusted account.
  • [REMOTE_CODE_EXECUTION]: The skill facilitates the installation of a socket server that allows an external agent to send and execute code on the host machine. This architecture creates a remote code execution capability by design.
  • [DYNAMIC_EXECUTION]: The primary function of the skill is the execute_code command, which allows for the execution of arbitrary Python code within the Blender process. This environment has full access to standard Python libraries, enabling unrestricted command execution on the host machine.
  • [COMMAND_EXECUTION]: The skill instructs the user to execute shell commands like curl to download external content and nc (netcat) to check local port status, which involves direct interaction with the host operating system.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 5, 2026, 12:07 PM