blender-mcp

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:25 AM UTC
• Version: 2.5.4

Overview

This Blender skill is purpose-aligned but exposes a powerful unsandboxed code-execution channel and relies on unpinned installation paths, so users should review it before installing.

Install only if you trust the Blender MCP package source and will run it in a controlled local environment. Prefer pinned versions, avoid pipe-to-shell installers, keep the service bound to localhost, do not enable Auto Start unless needed, and review every generated Python snippet before execution, ideally on disposable copies of Blender projects.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60
• Finding: Remote Installation Scripts Are Downloaded and Executed Without Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 60–63 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```bash # Install uv package manager first (if not installed) # Windows: powershell -c "irm https://astral.sh/uv/install.ps1 | iex" # Mac/Linux: curl -LsSf https://astral.sh/uv/install.sh | sh ``` ### Technical Analysis The installation instructions pass remotely retrieved content directly to command interpreters: - PowerShell's `irm` downloads the response and `iex` immediately evaluates it. - `curl` downloads the response and pipes it directly into `sh`. The downloaded content is not pinned to a reviewed version and is not verified using a cryptographic hash or publisher signature. Users also receive no mandatory opportunity to inspect the payload before execution. HTTPS and the use of Astral's recognized domain reduce ordinary interception risk, but they do not eliminate the risks of upstream infrastructure compromise, publisher-account compromise, DNS compromise, or future changes to the remotely hosted scripts. The effective code executed on a user's system can therefore change after this Skill has been reviewed. ### Attack Path 1. An attacker compromises the remote installer, its hosting infrastructure, the publisher account, or the delivery path. 2. A user follows the installation command documented in `SKILL.md`. 3. The attacker's modified response is downloaded from the expected URL. 4. `iex` or `sh` executes the response immediately without integrity verification. 5. The payload performs arbitrary actions using the invoking user's privileges. ### Impact Assessment A malicious installer could obtain all privileges available to the invoking user. Depending on that user's permissions, the payload could: - Read, modify, encrypt, or delete user-accessible files. - Access environment variables and locally available credentials. - Install additional software or persistence mechanisms. ...[truncated 364 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove both pipe-to-interpreter installation commands. 2. Direct users to the publisher's official manual installation documentation instead. 3. If automated installation is necessary: - Download a versioned installer artifact to a local file. - Pin the expected release version. - Verify a publisher signature or a documented SHA-256 digest. - Abort installation if verification fails. - Allow the user to inspect the downloaded file before execution. 4. Run installation with ordinary user privileges and explicitly warn users not to invoke it as an administrator or through `sudo`. 5. Prefer platform package managers that support signed, versioned packages. 6. Document the source, expected digest, destination files, and permissions needed by the installer. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:9
• Finding: Unpinned Third-Party Dependencies Are Installed and Executed<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md`, lines 9–14 - `SKILL.md`, lines 60–75 - `SKILL.md`, lines 805–827 - `README.md`, lines 45–53 **Vulnerability Type**: Insecure third-party dependency management **Risk Level**: High Relevant dependency declaration: ```yaml metadata: openclaw: requires: bins: ["blender", "mcporter"] install: - id: mcporter kind: node package: mcporter bins: ["mcporter"] label: "Install mcporter (npm)" ``` Installation and execution commands include: ```bash # Start MCP server directly (auto-downloads dependencies) uvx blender-mcp ``` ```bash # Install dependencies cd path/to/blender_mcp pip install mcp pyyaml starlette ``` ```bash # Install Gemini CLI npm install -g @google/gemini-cli ``` ```bash # Option A: mcporter (recommended) npm install -g mcporter mcporter config add blender-mcp --transport stdio --command "python -m blmcp --transport stdio" # Option B: uvx (simplest) uvx blender-mcp ``` ### Technical Analysis The Skill installs or executes dependencies by package name without pinning reviewed versions or recording integrity hashes. In particular, `uvx blender-mcp` resolves, downloads, and executes package code in one workflow. The pip and npm instructions similarly resolve current package releases and transitive dependencies at installation time. These resolved components can change independently of the Skill. Package installation hooks and runtime initialization can execute code using the installing user's privileges. The package names shown do not, by themselves, establish that any current package is malicious. The security issue is that dependency identity and content are not reproducibly constrained to versions reviewed by the Skill publisher. ### Attack Path 1. An attacker compromises a named package, a maintainer account, or a transitive dependency. 2. Alternatively, a future package release introduces malicious or vulnerable code. 3 ...[truncated 1055 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every directly installed package to an explicitly reviewed version. 2. Use lockfiles and package-manager integrity metadata for transitive dependencies. 3. For Python, use a fully pinned requirements file with hashes, such as `pip install --require-hashes -r requirements.txt`. 4. For npm, provide a reviewed lockfile and prefer reproducible installation with `npm ci`. 5. Avoid global installation where possible; use a dedicated, unprivileged project environment. 6. Replace `uvx blender-mcp` with an explicitly versioned invocation and document the reviewed version. 7. Verify package ownership and official publisher identities. 8. Use automated dependency scanning and promptly update pins after security review. 9. Document that users should not install these dependencies with administrator or root privileges. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:125
• Finding: Unsandboxed Arbitrary Python Execution Exceeds Minimum Required Privileges<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md`, lines 102–108 - `SKILL.md`, lines 125–158 - `SKILL.md`, lines 168–178 - `SKILL.md`, lines 188–189 - `SKILL.md`, lines 230–253 - `SKILL.md`, lines 297–306 - `SKILL.md`, lines 732–789 **Vulnerability Type**: Unrestricted code execution through an insufficiently constrained MCP/TCP interface **Risk Level**: High The Skill exposes arbitrary code execution through mcporter: ```bash # Call a specific tool mcporter call blender-mcp.execute_blender_code code='import bpy; result = {"objects": [o.name for o in bpy.data.objects]}' ``` It also documents a direct TCP execution client: ```python import socket import json def send_to_blender(code: str, host="localhost", port=9876, timeout=30.0) -> dict: """Send Python code directly to Blender Addon for execution.""" request = json.dumps({ "type": "execute", "code": code, "strict_json": False, }) + "\0" with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock: sock.settimeout(timeout) sock.connect((host, port)) sock.sendall(request.encode("utf-8")) buf = bytearray() while True: chunk = sock.recv(65536) if not chunk: break buf.extend(chunk) if b"\0" in buf: break line, _, _ = buf.partition(b"\0") return json.loads(line.decode("utf-8")) ``` The protocol accepts caller-provided Python source: ```json {"type": "execute", "code": "import bpy\nresult = {'key': 'value'}", "strict_json": false}\0 ``` The Skill explicitly acknowledges the missing sandbox: ```text ⚠️ **Official security warning**: The MCP Server executes LLM-generated code with **no sandboxing**. **Built-in weak sandbox** (`WeakSandboxForLLM`): - Blocks `sys.exit()` calls - Blocks dangerous operators: `wm.quit_blender`, `wm.read_factory_settings`, `wm.read_factory_userpref`, `wm.read_userpref` ``` ### Technical Analysi ...[truncated 2920 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable arbitrary Python execution by default. 2. Replace general code execution with allowlisted, narrowly scoped MCP methods for common Blender operations. 3. Validate every tool parameter, including object names, file paths, formats, and numeric ranges. 4. Require explicit user confirmation before arbitrary code runs: - Display the complete generated code. - Explain expected filesystem, process, and network effects. - Require a separate affirmative approval for each execution. 5. Run Blender and the MCP service under a dedicated, unprivileged operating-system account. 6. Apply operating-system sandboxing or container isolation: - Restrict the filesystem to approved project and output directories. - Deny access to credential stores and unrelated home-directory content. - Disable outbound networking unless specifically required. - Prevent child-process creation where practical. 7. Keep all listeners bound to `127.0.0.1` or `localhost`; reject `0.0.0.0` configurations. 8. Add authentication and per-session authorization even for local endpoints. 9. Disable Auto Start by default and clearly communicate that enabling it expands the endpoint's availability window. 10. Log execution requests and provide an emergency stop control. 11. Back up projects before code execution and use disposable copies for untrusted workflows. 12. Treat the documented weak sandbox only as an accidental-damage mitigation, not as a security boundary. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Install uv package manager first (if not installed)
# Windows: powershell -c "irm https://astral.sh/uv/install.ps1 | iex"
# Mac/Linux: curl -LsSf https://astral.sh/uv/install.sh | sh

# Start MCP server directly (auto-downloads dependencies)
uvx blender-mcp

• Confidence: 97% confidence
• Finding: The `| sh` pattern is an unsafe command chain that directly executes network-fetched content with shell privileges, removing any meaningful review step. In the context of this skill, which already exposes unsandboxed code execution through Blender MCP, this compounds risk by encouraging unsafe bootstrap behavior before the tool is even installed.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

# Install Gemini CLI
npm install -g @google/gemini-cli

# Configure MCP in ~/.gemini/settings.json
{
  "mcpServers": {
    "blender": {

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README advertises arbitrary `bpy` code execution as a feature but gives no warning that this allows arbitrary Python execution inside Blender, with the ability to modify files, scenes, plugins, and potentially the host environment accessible to Blender. In a skill designed for agent-driven remote control, omission of a prominent warning increases the chance that users expose a powerful execution channel without understanding the trust boundary.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The quick-install command `uvx blender-mcp` pulls the latest available package rather than a fixed reviewed release. That exposes users to supply-chain risk and silent behavioral drift, especially significant here because the package can control Blender and execute arbitrary `bpy` code through MCP.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The quick-install command `uvx blender-mcp` pulls the latest available package rather than a fixed reviewed release. That exposes users to supply-chain risk and silent behavioral drift, especially significant here because the package can control Blender and execute arbitrary `bpy` code through MCP.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: Referencing `uvx blender-mcp` again in the requirements/quick-start flow reinforces an unpinned installation path. If an attacker compromises the package distribution path or a later release introduces unsafe behavior, users following the README can unknowingly install and trust unreviewed code.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The quick-start example immediately demonstrates `execute_blender_code` without warning that the command can alter the scene, invoke Blender operators, access local files, or run arbitrary Python logic. Example-first guidance strongly encourages copy/paste use, so presenting code execution as a normal first-run action meaningfully increases the risk of unsafe deployment and misuse.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The skill instructs users to run `uvx blender-mcp`, which fetches and executes the latest published package without pinning a version or integrity constraint. In a skill whose core purpose is to bridge an LLM to arbitrary Blender Python execution, a compromised or unexpected upstream release could result in immediate execution of attacker-controlled code during install or startup.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: SQP-3 applies to all file types and covers language or locale policy violations. This file is primarily written in English, but line L529 switches to Chinese-only guidance for Blender 5.3 Alpha without user opt-in or an explicit statement that the skill is intended for Chinese readers, which can force a specific language on users unexpectedly.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: This is another unpinned `uvx blender-mcp` invocation, again causing dynamic retrieval and execution of whatever package version is current at runtime. Because the package controls MCP connectivity and exposes arbitrary `bpy` code execution, the blast radius is larger than a normal unpinned utility install.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence
• Finding: uvx/uv tool run commands without ==version create a rug-pull risk.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Write-Host "`n[1/4] Publishing SKILL.md..." -ForegroundColor Yellow
$skillBytes = [System.IO.File]::ReadAllBytes("$skillDir\SKILL.md")
$skillBase64 = [Convert]::ToBase64String($skillBytes)
$skillRemoteSha = gh api repos/taosiuman/blender-skill/contents/SKILL.md --jq '.sha'
$skillPayload = @{
    message = "v2.5.1: 5.3 Alpha API 增量更新 (18 项新增)"
    content = $skillBase64

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Write-Host "`n[1/4] Publishing SKILL.md..." -ForegroundColor Yellow
$skillBytes = [System.IO.File]::ReadAllBytes("$skillDir\SKILL.md")
$skillBase64 = [Convert]::ToBase64String($skillBytes)
$skillRemoteSha = gh api repos/taosiuman/blender-skill/contents/SKILL.md --jq '.sha'
$skillPayload = @{
    message = "v2.5.1: 5.3 Alpha API 增量更新 (18 项新增)"
    content = $skillBase64

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This script performs GitHub content updates, tag mutation, and release creation for an external repository, which is unrelated to the stated purpose of connecting to and controlling Blender via MCP. If bundled with the skill and executed in a trusted automation context, it can use the operator's GitHub credentials to modify repository contents and releases, creating unnecessary supply-chain and account-scope risk.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script invokes `gh api` and `gh release create` to modify GitHub repository files, force-update a tag, and create a release, giving the skill package outbound capability to alter external infrastructure. That capability is not justified by a Blender-control skill and becomes dangerous if a user or agent executes the script with authenticated GitHub CLI credentials, because it can perform repository-side changes outside the expected Blender domain.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: Several release-note entries are written in Chinese within an otherwise English README, which imposes a language assumption on readers without opt-in or explanation. The policy scope includes natural-language language/locale violations when a specific language is forced without user choice.

External Script Fetching

Low

• Category: Supply Chain

Content

```bash
# Install uv package manager first (if not installed)
# Windows: powershell -c "irm https://astral.sh/uv/install.ps1 | iex"
# Mac/Linux: curl -LsSf https://astral.sh/uv/install.sh | sh

# Start MCP server directly (auto-downloads dependencies)
uvx blender-mcp

• Confidence: 95% confidence
• Finding: The skill recommends `curl -LsSf https://astral.sh/uv/install.sh | sh`, which downloads a remote script and executes it immediately. This creates a classic supply-chain and man-in-the-middle risk surface, especially dangerous in a skill already designed to install tooling that can drive Blender and execute arbitrary code paths.

Rp1

Low

• Category: MCP Rug Pull
• Confidence: 72% confidence
• Finding: `pip install mcp pyyaml starlette` installs dependencies without version pinning, which weakens reproducibility and allows unexpected or compromised upstream versions to be pulled later. While this is common documentation shorthand, in a tool that mediates local code execution and networked control of Blender, dependency drift materially increases supply-chain risk.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The surrounding README content is in English, but this line adds Chinese-only update metadata. Under SQP-3, forcing a different language in natural-language instructions or status text without opt-in is a policy concern even when the content is informational rather than operational.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: This markdown file contains user-facing natural-language content entirely in Chinese, but it does not indicate that the skill is region-specific or provide an opt-in for language/locale. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The entire document is written in Chinese, including headings and warnings, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.