ClawHub
Back to skill

Security audit

Modeling Assistant

Security checks across malware telemetry and agentic risk

Overview

This skill gives an agent instructions to generate simple Blender models from user requests and export them locally; the main risk is accidental overwriting or scene clearing, not hidden or malicious behavior.

Before using the skill, direct the agent to work in a new or temporary Blender file and choose unique output filenames instead of fixed Desktop paths. Avoid running it against an existing .blend file unless you are comfortable with the scene being cleared.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly instructs clearing the entire Blender scene and exporting files to fixed user locations, but it does not require confirmation, warn about destructive behavior, or guard against overwriting existing files. In this context, the danger is amplified because the skill is designed to execute Blender non-interactively in background mode, so destructive actions can occur without visible prompts or an opportunity for the user to intervene.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.