Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
SynthClaw
v0.1.3Render Blender files with agent-controlled procedural parameters for synthetic data generation. Use when generating training data with controlled variations,...
⭐ 0· 75·0 current·0 all-time
byArtur Yakimovich, PhD@ayakimovich
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The code and SKILL.md align with the described purpose: they analyze .blend files, locate Value Nodes, update them and run headless Blender renders. However the registry metadata lists no required binaries while SKILL.md and the code require the 'blender' executable to be on PATH. pyproject.toml declares dependencies (granatpy, lpips) that are relevant for optional metrics but the registry metadata did not surface them. These manifest/metadata omissions are incoherent and worth verifying.
Instruction Scope
Runtime instructions and code are scoped to reading .blend files, optionally a reference image, updating node values, and invoking Blender headlessly. The scripts do not access network endpoints, other credentials, or unrelated system paths. They accept a reference_image path (if provided) and will read that file for metrics — expected for the stated compute_metrics feature.
Install Mechanism
There is no install spec in the registry (instruction-only), but the package includes source files and a pyproject.toml declaring non-trivial dependencies (granatpy, lpips). Because there's no installer step provided, an operator must manually ensure these Python packages (and their native dependencies like PyTorch for LPIPS) are installed. This omission is a configuration/documentation mismatch rather than direct malicious behavior.
Credentials
The skill requests no secrets and does not declare required env vars; the code optionally reads BLENDER_ENGINE and BLENDER_SAMPLES from the environment (benign). The compute_metrics path imports heavy third-party libraries (granatpy, lpips/torch) and will read a reference image file if supplied — both are proportional to the feature but increase the runtime dependency/attack surface. The registry should have declared Blender as a required binary and called out those optional dependencies.
Persistence & Privilege
always:false and no code writes to other skills or system-wide agent settings. The skill runs Blender subprocesses and local scripts but does not claim or request elevated, persistent privileges.
What to consider before installing
This skill appears to implement the documented Blender rendering functionality, but there are a few mismatches you should address before installing or running it in a productive environment:
- Ensure Blender is installed and available on PATH (SKILL.md and the code require the 'blender' binary, but the registry metadata omitted this). The skill will fail or behave unexpectedly without Blender 4.0+.
- The package declares optional metrics dependencies (granatpy, lpips). If you enable compute_metrics, you must install these Python packages and their native dependencies (LPIPS typically requires PyTorch). Installing them increases the runtime footprint — consider doing that in an isolated environment.
- The skill will read any file paths you pass (blend_file, output_path directory, reference_image). Be cautious about allowing the agent to pass arbitrary filesystem paths; it can read local images used for metric computation.
- Tests reference assets/low.blend and assets/high.blend that are not present in the manifest. Expect some test/setup friction; verify asset availability if you plan to run tests.
- Metadata/documentation gaps (missing required binary and missing declared install steps) are likely accidental but important. If you plan to use this skill, verify these items manually, run it in a sandbox/VM first, and avoid exposing sensitive files to the agent's working directory.
If you want higher assurance, ask the publisher for an install spec or a small trusted release (e.g., pip package or GitHub release) and a clear list of required system packages for the metrics features before enabling this skill in a production agent.Like a lobster shell, security has layers — review code before you run it.
latestvk97dpgv43bp55z21netm40kbdh83j0ya
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
