ClawHub
Back to skill

Security audit

Blender Render

Security checks across malware telemetry and agentic risk

Overview

This skill runs local Blender scripts to turn user-selected 3D files into preview images, and the behavior is disclosed and aligned with that purpose.

Install only if you are comfortable running local Blender/Python scripts on model files you choose. Use a trusted Blender installation, install optional Pillow only from trusted sources if you need contact sheets, and run these commands in a fresh headless Blender session rather than against an unsaved or important .blend project.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script unconditionally selects and deletes all objects in the currently opened Blender scene before importing the FBX. In a headless automation context this may be intentional, but if run against an unsaved or important .blend file, it can destroy user work or pipeline state without warning, isolation, or validation that the scene is disposable.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.