SynthClaw

• Outcome: Review
• Latest audit: Jul 13, 2026 · 11:54 AM UTC
• Version: 0.2.6

Overview

This Blender rendering skill mostly matches its purpose, but it needs Review because it runs user-supplied Blender files with the normal environment and can delete TIFF files inside the chosen output folder.

Install only if you are comfortable running Blender on the .blend files you provide. Use trusted files, run it in a low-privilege or sandboxed environment without sensitive environment variables, and choose a fresh output directory because dataset cleanup may remove TIFF files under that directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

]

    try:
        result = subprocess.run(command, capture_output=True, text=True, check=True)
        # Parse output between markers
        output = result.stdout
        if "---ANALYSIS_START---" in output and "---ANALYSIS_END---" in output:

• Confidence: 93% confidence
• Finding: The function invokes the external Blender binary on a user-supplied .blend file, which is a risky file format because opening Blender project files can trigger embedded Python, drivers, or other content processed by Blender. Although shell injection is avoided by passing an argument list, this still creates an unsafe execution boundary where attacker-controlled files may cause code execution or other harmful side effects inside the Blender process.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""
    # Use start_new_session=True to run in a separate process group on Unix.
    # This ensures that Blender and any spawned child processes are killed on timeout.
    proc = subprocess.Popen(
        command,
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,

• Confidence: 93% confidence
• Finding: This code launches Blender as an external process using a user-influenced .blend file and supporting scripts. While it avoids shell injection by passing an argument list to Popen, opening untrusted .blend content and executing Blender Python scripts is still a high-risk execution boundary because Blender files and add-ons can trigger arbitrary code or dangerous file/network activity inside the spawned process.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation advertises capabilities that invoke Blender via subprocesses, read .blend and image files, write rendered outputs, and depend on environment state such as PATH, but it does not declare corresponding permissions. This creates a mismatch between the skill's stated trust boundary and its actual execution capabilities, making it harder for a host agent or reviewer to enforce least privilege and increasing the risk of unintended file access or command execution pathways.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script exports a detailed inventory of the Blender scene, including collection hierarchy, object names, transforms, render visibility, and material usage, which goes beyond the stated purpose of rendering and quality-metric guidance. In an agent setting, this broad introspection can leak proprietary scene structure or embedded asset metadata from user-supplied .blend files without a clear need-to-know boundary.

Description-Behavior Mismatch

High

• Confidence: 79% confidence
• Finding: The implemented analysis computes only heuristic scene complexity from polygons, materials, lights, and render engine, while the skill description claims dynamic quality metrics like Naturalness, LPIPS, and dataset diversity. This mismatch is security-relevant because agents or users may trust the script as performing bounded metric evaluation when it actually performs different scene inspection behavior, undermining informed consent and increasing the chance of unintended data exposure or unsafe automation decisions.

Intent-Code Divergence

Medium

• Confidence: 75% confidence
• Finding: The docstring states the script outputs realism metrics and available Value Nodes, but the actual code emits heuristic complexity plus broad scene inventory data. Misleading inline documentation is not harmful by itself, but in a security-sensitive agent ecosystem it can conceal overcollection and cause downstream tooling to invoke the script under false assumptions about what data it accesses and returns.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script unconditionally selects and deletes all existing Blender objects in the current scene before creating test content. If run in an unexpected context, such as an open user project rather than an isolated temporary scene, it can destroy in-memory work and overwrite expected state without warning, which is a real integrity and availability risk even if the author likely intended only to initialize a clean test file.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: This code silently launches Blender in background mode on a supplied file without any explicit warning or consent boundary. In the context of agent skills, hidden execution of a complex DCC application on untrusted project files increases operational risk because users or calling agents may incorrectly assume this is a passive parse rather than active file processing with code-execution potential.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

param_args = [f"{k}={v}" for k, v in parameters.items()]
    
    # Pass engine and samples to the Blender script via environment variables
    env = os.environ.copy()
    env["SYNTHCLAW_PACKAGE_PATH"] = os.path.abspath(os.path.join(MODULE_DIR, ".."))
    env["BLENDER_ENGINE"] = engine
    env["BLENDER_SAMPLES"] = str(samples)

• Confidence: 96% confidence
• Finding: Copying the full parent environment into a child process that handles potentially attacker-supplied Blender inputs can expose secrets such as API tokens, cloud credentials, proxies, or internal configuration to that process and any code it executes. In this skill context, Blender is effectively a code-execution boundary, so inheriting all environment variables materially increases the blast radius if the .blend file, Blender runtime, or invoked script is malicious or compromised.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

script_path = os.path.join(SCRIPTS_DIR, "render_dataset.py")
        
        # Pass engine and samples to the Blender script via environment variables
        env = os.environ.copy()
        env["SYNTHCLAW_PACKAGE_PATH"] = os.path.abspath(os.path.join(MODULE_DIR, ".."))
        env["BLENDER_ENGINE"] = engine
        env["BLENDER_SAMPLES"] = str(samples)

• Confidence: 96% confidence
• Finding: The dataset-render path repeats the same environment inheritance problem: a potentially untrusted Blender execution context receives the entire parent environment. Because this mode runs longer and may process more data, it may offer even more opportunity for credential theft or misuse by malicious blend content or scripts.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.