Blender Mcp

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:32 AM UTC
• Version: 0.1.0

Overview

This Blender control skill is not malicious, but it deserves review because it enables powerful local Blender actions and runs mutable external code without enough safety framing.

Install only if you trust the Blender MCP package and add-on source. Use a pinned, reviewed version where possible, work on project copies or backups, and require explicit approval before running arbitrary Blender Python or deleting/modifying important scene content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/start-server.sh:10

Finding

Unpinned Third-Party Components Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: scripts/start-server.sh:10-12; related installation guidance in README.md:22-30 and SKILL.md:13-15
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

scripts/start-server.sh:10-12:

bash

# Start blender-mcp
echo "Starting Blender MCP server..."
uvx blender-mcp

Related instructions in README.md:22-30:

markdown

BlenderMCP is automatically available via uvx:
```bash
uvx blender-mcp

2. Install Blender addon

1. Download addon.py from https://github.com/ahujasid/blender-mcp

text

Related prerequisite in `SKILL.md:13-15`:

```markdown
1. Blender installed and running
2. BlenderMCP addon installed in Blender
3. blender-mcp Python package installed via uvx

Technical Analysis

The startup script invokes uvx blender-mcp without specifying an exact package version, hash, or trusted artifact source. Depending on the local uvx cache and package resolution state, this can retrieve and execute a mutable package from the configured Python package index at runtime.

The installation documentation also directs users to download a mutable addon.py file from a GitHub repository without identifying a release, commit hash, expected checksum, or signature. Therefore, the code that ultimately runs is not fully represented by the audited project and may change after this review.

This creates a supply-chain trust weakness. Compromise of the package publisher, package index, upstream repository, or release process could result in different code being installed or executed under the legitimate blender-mcp name. The reviewed repository does not itself contain a malicious payload, and successful exploitation depends on compromise or substitution of an external component.

Attack Path

1. An attacker compromises the upstream package publisher, repository, distribution account, or another com ...[truncated 1461 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin blender-mcp to a reviewed, exact version rather than resolving the latest available package at runtime, for example:

   bash

   uvx blender-mcp==<reviewed-exact-version>
   

2. Where supported, lock the complete transitive dependency graph and verify package hashes using a committed lock file or equivalent reproducible dependency mechanism.

3. Pin the Blender add-on to a specific trusted release or full commit hash instead of downloading a mutable repository file.

4. Publish and verify a SHA-256 checksum or cryptographic signature for the expected package and add-on artifacts before execution or installation.

5. Document the expected package publisher, repository, release identifier, and verification procedure.

6. Avoid automatically resolving and executing mutable remote dependencies during normal startup. Install reviewed artifacts separately and invoke the installed, verified executable.

7. Run Blender and the MCP server under a dedicated, least-privileged account or sandbox with access limited to required project directories.

8. Restrict outbound network access where feasible and monitor dependency updates through a controlled review process.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README explicitly advertises arbitrary Blender Python execution and direct scene manipulation but provides no warning that this gives the agent code-execution capability inside Blender and can modify or destroy user projects. In this skill context, that is especially dangerous because the whole purpose is remote control of a creative application with access to local files, scene data, and rendering workflows.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

md

- 🎨 Full control over Blender through the BlenderMCP socket interface
- 🧩 Can execute arbitrary Blender Python code from OpenClaw
- 📐 Create accurate architectural models like Hagia Sophia (example included!)
- 🎬 Supports camera animation and rendering
- 🌳 Includes helper scripts for connection testing

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The README instructs users to run an unpinned package via uvx blender-mcp, which allows whatever the latest published version resolves to at execution time. This creates a supply-chain risk: a compromised upstream release or breaking update could execute unintended code on the user's machine when installing or starting the MCP server.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill instructs users to run uvx blender-mcp without pinning a specific package version. That creates a supply-chain risk because a newer or compromised package release could be fetched and executed unexpectedly, and this skill has access to a Blender control channel with powerful scene and code-execution capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The listed toolset includes destructive actions (delete_object) and arbitrary code execution (execute_code) but the skill provides no warning, approval guidance, or safety boundaries. In this context, that is more dangerous because the skill is specifically designed to control a live Blender instance, so unsafe prompts could directly trigger irreversible scene changes or execution of Python inside Blender.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The script executes uvx blender-mcp without pinning an explicit version or immutable source reference. That means each run may resolve whatever package version is current at execution time, increasing supply-chain risk from malicious updates, compromised releases, or unexpected breaking changes; in this skill's context, that is more dangerous because the MCP server is intended to control Blender and manipulate local 3D scenes/files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.