Security audit

blender-mcp

Security checks for vulnerabilities and agentic risk

Overview

The skill needs review because its quick-install instructions mix the official Blender add-on with a separately published community server.

Resolve which server package belongs with the official add-on before installing; version pinning alone does not establish its publisher. Review downloaded installers and generated Python, keep the server local, back up projects, and verify telemetry settings for the server you actually install. The inspected bundle does not demonstrate malicious intent.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · README.md (reported line 90)May include surrounding context.
md
### Previous Updates / 之前的更新 **v2.5.9 (2026-09-23):** Security release — removed dangerous `curl | sh` pattern, added explicit bpy-execution warnings, pinned dependency versions, bilingual (EN/CN) docs **v2.5.8:** 8 new APIs + 2 breaking changes documented - CollectionChild.sort_index, ColorManagedInputColorspaceSettings.interop_id, etc.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · README.md (reported line 268)May include surrounding context.
md
- 🏗 修复版本号漂移：`version` / README 版本行 / Changelog 三处强制一致 ### v2.5.9 (2026-09-23) — Security Release / 安全发布 - 🔒 Removed dangerous `curl | sh` pattern from documentation / 从文档中移除危险的 `curl | sh` 模式 - 🔒 Added explicit security warnings about bpy code execution / 添加关于 bpy 代码执行的明确安全警告 - 🔒 Pinned dependency versions (uvx, pip) / 固定依赖版本（uvx、pip） - 🔒 Clarified telemetry defaults and opt-out / 明确遥测默认值和退出方式

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · README.md (reported line 268)May include surrounding context.
md
- 🏗 修复版本号漂移：`version` / README 版本行 / Changelog 三处强制一致 ### v2.5.9 (2026-09-23) — Security Release / 安全发布 - 🔒 Removed dangerous `curl | sh` pattern from documentation / 从文档中移除危险的 `curl | sh` 模式 - 🔒 Added explicit security warnings about bpy code execution / 添加关于 bpy 代码执行的明确安全警告 - 🔒 Pinned dependency versions (uvx, pip) / 固定依赖版本（uvx、pip） - 🔒 Clarified telemetry defaults and opt-out / 明确遥测默认值和退出方式

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 1053)May include surrounding context.
md
- 研究追踪与发布流程改由 `blender-autolearn` 技能 + 定时任务驱动 ### v2.5.9 (2026-09-23) — Security Release - 🔒 Removed dangerous `curl | sh` pattern from installation docs - 🔒 Added bilingual security warnings (EN/CN) about bpy code execution risks - 🔒 Pinned dependency versions: `uvx blender-mcp==1.0.0`, `pip install mcp==1.8.0 pyyaml==6.0.2 starlette==0.45.0` - 🔒 Clarified telemetry defaults and opt-out mechanism

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Although the comments concern Blender, they do not implement or document the declared MCP workflow, tools, TCP protocol, or bpy execution capability. The supplied content therefore has a materially different purpose. No undeclared resource access or executable behavior is present in this chunk.
Content: No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 1000)May include surrounding context.
md
ELEASE … Released October 22, 2026"）。技能内版本口径统一改为 **5.2.x LTS（当前 5.2.3）**（共 3 处：`SKILL.md` 版本支持行 + 5.4 分段说明 + README 版本行/兼容表）

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 1005)May include surrounding context.
md
- ✅ 版本号三处一致：`SKILL.md` frontmatter / README 版本行 / 两处 Changelog = **3.5.1**（远端基线 v3.5.0）

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 1013)May include surrounding context.
md
- ✅ 版本号三处一致：`SKILL.md` frontmatter / README 版本行 / 两处 Changelog = **3.5.0**；**已双平台发布（2026-10-20 13:21）**：GitHub `taosiuman/blender-skill` tag `v3.5.0` ＋ ClawHub

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 1020)May include surrounding context.
md
- ✅ 版本号三处一致：`SKILL.md` frontmatter / README 版本行 / 两处 Changelog = **3.4.0**；**已双平台发布（2026-10-16 10:41）**：GitHub `taosiuman/blender-skill` tag/Release **v3.4.0**（

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 1028)May include surrounding context.
md
- ✅ 三处版本号一致：`SKILL.md` frontmatter / README 版本行 / 两处 Changelog = **3.3.0**；**双平台发布仍待用户确认**（v3.2.0 未发布 → 本次发布一并覆盖两版变更）

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 1035)May include surrounding context.
md
- ✅ 版本号三处一致：`SKILL.md` frontmatter / README 版本行 / 两处 Changelog 均为 **3.2.0**；**双平台发布待用户确认**

MCP server referenced without pinned version: 'uvx quick'.

Medium

Category: MCP Rug Pull
Confidence: 65% confidence
Finding: uvx/uv tool run commands without ==version create a rug-pull risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.