ClawHub
Back to skill

Security audit

Blender Mcp

Security checks for vulnerabilities and agentic risk

Overview

This Blender bridge appears purpose-aligned, but it exposes high-impact local code execution and runtime package execution without enough scoping or user control.

Review before installing. Use this only in a constrained Blender environment you trust, with sensitive files and credentials kept out of reach. Prefer a pinned, reviewed `blender-mcp` version, explicit user approval for `execute_code`, downloads, saves, and renders, and a tool allowlist or sandbox before routine use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
server.js:19
Finding

Unpinned Third-Party Package Is Resolved and Executed at Runtime

Content
View full analysis

Vulnerability Details

File Location: server.js:19-28
Vulnerability Type: Unpinned runtime dependency execution
Risk Level: High

Vulnerable Code

js
// UV path check or command
let uvxCmd = 'uvx';
const localBin = path.join(process.env.USERPROFILE, '.local', 'bin', 'uvx.exe');
if (fs.existsSync(localBin)) {
  uvxCmd = localBin;
}

this.process = spawn(uvxCmd, ['blender-mcp'], {
  stdio: ['pipe', 'pipe', 'pipe'],
  shell: process.platform === 'win32'
});

Technical Analysis

The bridge invokes uvx with the bare package name blender-mcp. No package version, cryptographic hash, controlled package index, or verified local environment is specified. Consequently, the code that runs can change independently of the reviewed Skill.

The npm lockfile does not mitigate this issue because it only controls the JavaScript dependency tree. It does not pin or verify the Python package resolved by uvx.

Runtime package resolution creates a supply-chain trust boundary at every fresh installation or environment resolution. If the package, one of its transitive dependencies, the selected package registry, or the local package-resolution configuration is compromised, attacker-controlled code can execute with the privileges of the bridge process.

Attack Path

  1. An attacker compromises the blender-mcp package, one of its transitive dependencies, or a package source selected by the local uvx configuration.
  2. A user or agent invokes the Skill in an environment where the affected package version has not already been securely pinned and cached.
  3. server.js runs uvx blender-mcp.
  4. uvx resolves and starts the attacker-controlled or compromised package.
  5. The malicious package executes with the operating-system privileges and environment access of the Skill process.
  6. It can potentially read accessible files and environment variables, make network connections, alter Blender data, ...[truncated 620 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin blender-mcp to a specific, reviewed version rather than resolving a bare package name.
  2. Lock all transitive Python dependencies and verify package hashes.
  3. Install dependencies during a controlled deployment phase instead of resolving and executing them dynamically at runtime.
  4. Configure an explicit trusted package index and prevent untrusted environment configuration from overriding package sources.
  5. Invoke a verified executable from an application-owned virtual environment using an absolute path.
  6. Verify the executable or environment against an expected digest before startup.
  7. Run the MCP process in a sandbox or container with restricted file-system, network, environment-variable, and operating-system access.
  8. Maintain a software bill of materials and regularly review pinned packages for disclosed vulnerabilities.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
server.js:86
Finding

Unrestricted Forwarding Exposes Arbitrary Blender Python Execution

Content
View full analysis

Vulnerability Details

File Location: server.js:86-105; dangerous capability documented at SKILL.md:26-35
Vulnerability Type: Missing tool authorization and input restrictions for a code-execution interface
Risk Level: High

Vulnerable Code

js
async callTool(name, args = {}) {
  await this.start();
  const req = {
    jsonrpc: '2.0',
    id: this.nextId++,
    method: 'tools/call',
    params: { name, arguments: args }
  };
  return this.sendRequest(req);
}
}

const client = new BlenderMcpClient();

export async function execute(inputs) {
  const { tool, arguments: args } = inputs;
  
  // Optimization: Auto-discovery if tool is missing
  if (!tool) {
     return { error: true, message: "Missing tool name. Available: execute_code, search_sketchfab_models, download_sketchfab_model, get_scene_info" };
  }

  try {
    const result = await client.callTool(tool, args || {});
    return result;

The Skill documentation explicitly exposes the code-execution tool:

md
| `execute_code` | `code` (Python BPY) | Le couteau suisse (Caméra, Rendu, Save). |

Technical Analysis

execute() accepts a caller-controlled tool value and caller-controlled arguments, then forwards both directly to the MCP server. The only check verifies that a tool name is present. There is no:

  • Server-side tool allowlist
  • Per-tool authorization policy
  • Argument schema validation
  • Restriction on Python modules or APIs
  • Confirmation boundary for dangerous operations
  • Separation between read-only and code-execution operations

The documentation establishes that execute_code accepts Python code for execution through Blender. Blender Python is not inherently limited to geometry operations: unless separately sandboxed by the downstream MCP server or operating system, Python executed inside Blender can generally interact with files, processes, environment variables, and net ...[truncated 1809 chars]

Remediation
View remediation

Remediation Suggestions

  1. Disable execute_code by default and expose narrowly scoped operations for scene inspection, object creation, materials, camera configuration, and rendering.
  2. Enforce a server-side allowlist of approved tool names rather than forwarding arbitrary names.
  3. Define strict schemas for every tool’s arguments and reject unknown fields, oversized values, invalid types, and unsafe paths.
  4. Separate read-only operations from scene-mutating and code-execution operations.
  5. Require explicit, informed user approval before code execution, external downloads, file writes, or process creation.
  6. If Python execution is essential, execute only reviewed templates with constrained parameters rather than raw caller-provided source code.
  7. Run Blender and the MCP server in a sandboxed, low-privilege account or container with:
    • A restricted file-system view
    • No unnecessary credentials or environment variables
    • Denied process-spawning capabilities where possible
    • Network access disabled or limited to approved destinations
    • Resource limits for CPU, memory, execution time, and output size
  8. Apply authorization checks at the MCP server as well as in this bridge so callers cannot bypass protections by connecting through another client.
  9. Log dangerous tool requests and security decisions without recording sensitive code, credentials, or file contents.
  10. Add negative tests confirming that unknown tools, raw Python, unsafe paths, and unapproved external operations are rejected.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (8)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill exposes powerful MCP/code-execution capabilities but declares no explicit tool scope or permissions boundary. In practice, this can let the agent invoke scene inspection, model downloads, and arbitrary Blender Python execution without a clear least-privilege contract, increasing the chance of unsafe file, network, or host-side actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly describes save and render operations, including writing a .blend file and rendering output, but does not warn that these actions modify local files and the current Blender scene. In a bridge that also supports arbitrary BPY execution, omission of these warnings can lead to silent overwrites, unwanted renders, or destructive scene changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The usage guidance is broad enough that the skill may auto-trigger for generic 3D or modeling requests, even when the user did not specifically ask to connect to a live Blender instance. Because this skill can modify scene state and run custom BPY code, overbroad routing materially increases the chance of unintended privileged actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill silently spawns an external executable ('uvx' or a local uvx.exe) and connects it to a long-lived stdio bridge without any user-visible disclosure or trust boundary checks. In this context, the risk is higher because the spawned MCP server can expose powerful Blender actions, including the advertised ability to run custom BPY code in real time, so users may unknowingly trigger local code execution paths.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest describes a bridge for querying and manipulating Blender scenes and running BPY code. However, the advertised available tools include search_sketchfab_models and download_sketchfab_model, which add external asset discovery/download behavior not justified by the stated purpose of a real-time Blender bridge.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The code launches an external process via spawn(..., shell: true) but provides no confirmation prompt, user-facing log message, or explanatory comment describing that it will execute a local command. For code files, subprocess execution should be disclosed unless it is clearly part of the stated skill purpose, which is not evident from this file alone.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction text is written as a directive in French and implicitly requires the skill behavior to follow that language context, without offering the user a language choice. This can violate language/locale policy when the user's preferred language is not French.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The dependency uses a caret range (^3.3.2), which allows automatic installation of newer compatible versions instead of a fully fixed release. This increases supply-chain risk because a compromised or buggy upstream publish could be pulled into this bridge, and the skill context is moderately sensitive since it interfaces with Blender and may help drive code-execution workflows elsewhere in the project.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json
"start": "node server.js"
  },
  "dependencies": {
    "node-fetch": "^3.3.2"
  }
}

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
server.js:29

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
test.js:5