Security audit

Blender 资产生成

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a normal Blender asset generator, but its export path handling can write generated files outside the project folder if a spec is unsafe.

Review generated spec.json before running Blender. Only allow export_glb, export_fbx_optional, and export_usdc_optional values under exports/ with no absolute paths or .. components, and run the project in a dedicated workspace. Expect macOS support in the shipped scripts; Windows/cloud commands are described but the referenced runner files are missing.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: assets/project-skeleton/run_local_macos.sh:29
Finding: Unrestricted Export Paths Allow Writes Outside the Project Directory
Content: View full analysis
Remediation: View remediation
Path: root = (Path(project_root) / "exports").resolve() candidate_name = Path(configured_path) if candidate_name.is_absolute() or ".." in candidate_name.parts: raise ValueError("Export path must be a safe relative path") candidate = (root / candidate_name.name).resolve() if candidate.parent != root: raise ValueError("Export path escapes the exports directory") if candidate.suffix.lower() != suffix: raise ValueError(f"Export path must end with {suffix}") return candidate ``` For stronger isolation, store only basename fields in the specification, such as `asset.glb`, and have the runtime always construct the directory itself. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The code does relate to Blender-based 3D asset creation, so it is partially aligned at a high level. However, the supplied chunk specifically runs a local macOS workflow for one predefined donut scene and associated renders/exports. The declared description claims broader capabilities: ecommerce/game/teaching asset generation, compatibility/support for cloud Windows and local machines, and a reference-image guided workflow with graceful degradation when vision is unavailable. None of those broader or cross-platform features are evidenced here. This is therefore a material description-to-behavior mismatch, primarily due to overstated scope and platform/workflow claims.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code does perform Blender-based 3D asset generation, which aligns with the general domain of the description. However, the declared description emphasizes broader capabilities that are not represented in this code chunk: there is no reference-image input, no vision-related branching or fallback behavior, and no sophisticated asset generation beyond a small set of hardcoded primitives (box, cylinder, bottle-like) with simple placeholder materials. The script’s primary behavior is a spec-driven procedural builder for basic assets, not a reference-image guided workflow. Therefore the description overstates the implemented capabilities in a materially relevant way.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill describes behavior that will generate files and provide runnable commands for PowerShell, shell, and Blender execution, but it does not declare any explicit tool scope such as allowed tools or permissions. In an agent environment, this creates an over-broad trust boundary where file write and shell-capable actions may be invoked without clear restriction, increasing the risk of unsafe command execution or unintended filesystem changes.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.