T09 · Insecure Skill Coding Practices
Warning
- Location
demo_gear.py:279- Finding
Predictable Shared Temporary Paths Permit Output Clobbering
- Content
View full analysis
- Remediation
View remediation
Security audit
Blender Bpy Enhanced
Security checks for vulnerabilities and agentic risk
Overview
This Blender automation skill is coherent, but it needs Review because its examples and demo scripts can delete the current Blender scene and overwrite fixed temporary output files without confirmation.
Install only if you are comfortable reviewing generated Blender scripts before execution. Run the demo in a new or disposable Blender file, avoid running it in an active project, and change output paths to a private or user-selected directory before rendering or saving.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/blender_demo_gear.py:279- Finding
Predictable Shared Temporary Paths Permit Output Clobbering in Duplicate Demo Script
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:199- Finding
Documentation Promotes a Predictable Shared Temporary Output Path
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documented scene setup performs unconditional deletion of all selected objects and then removes all materials from the Blender file, which can destroy existing work if run in the wrong project or context. In an automation skill, users may copy this boilerplate into live scenes or headless jobs without realizing it is destructive, making accidental data loss a realistic risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script immediately deletes all objects in the current Blender scene and removes all materials without any prompt, scope check, or requirement to operate on a fresh file. In an automation skill, this can cause accidental destruction of a user's working scene or unsaved assets if run in the wrong context, making it a real integrity risk even if the demo's intent is not malicious.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script immediately selects and deletes all objects and removes all materials from the currently open Blender scene, which is destructive behavior unrelated to the minimum required action of generating a demo gear. In a user’s active project, this can cause loss of unsaved work or corruption of the working scene state without warning or isolation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Deleting the current Blender scene contents without any confirmation or warning is unsafe because users may run the script in an existing project context expecting only asset creation. The skill context makes this more dangerous, not less, because a modeling automation skill is likely to be executed inside valuable interactive workspaces.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script saves a .blend file and writes a rendered PNG to fixed paths under /tmp without this behavior being clearly disclosed in the skill description or gated by user input. While /tmp is less sensitive than arbitrary filesystem locations, undisclosed file creation can leak project artifacts, overwrite prior temp files, and violate least-surprise expectations.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The render and export examples write output files to disk, including a default path under /tmp and a model export path, without prominently warning users that execution causes filesystem side effects. While expected for rendering/export automation, undocumented writes can still overwrite files, leak artifacts into shared locations, or violate user expectations in automated environments.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script writes a .blend file and rendered PNG to fixed paths in /tmp and does so automatically, without prior disclosure or opt-in. While /tmp is lower risk than user home directories, silent file creation/overwrite can still clobber prior outputs, leak generated content to shared temporary storage, and violate user expectations in an automation environment.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
Writing output files to /tmp without warning is lower severity than scene deletion, but it still performs side effects outside in-memory scene generation and may surprise users or other tooling. In automation contexts, silent file output can create privacy, reproducibility, and overwrite issues, especially if the temp directory is shared or monitored.
- Content
Static analysis
No suspicious patterns detected.