blender-toolkit — agentic threat model

Not certain from the listing — relies on the host Claude Code model (likely Claude 3.5 Sonnet) for translating user intent into Blender CLI/WebSocket commands. Vulnerable to prompt injection that could force the generation of malicious Python scripts or destructive Blender commands.

Not certain from the listing — primarily processes local 3D assets, geometry, materials, and Mixamo animation files. There is no explicit mention of vector databases or RAG, but malicious 3D files could exploit parser vulnerabilities in Blender.

Integrates as a Claude Code plugin. The framework translates natural language into structured WebSocket payloads and CLI commands. Insecure tool integration is a high risk if the plugin does not strictly sanitize inputs before passing them to the Blender Python API.

Opens a local WebSocket connection to a running Blender instance. This creates an unauthenticated network-accessible control surface on the host machine, risking unauthorized local or lateral access if the WebSocket port is exposed to the local network.

Not certain from the listing — there are no mentioned logging, guardrails, or safety monitoring mechanisms to intercept malicious or destructive Blender commands before they are executed via the WebSocket.

Lacks explicit authentication or authorization controls for the WebSocket connection. Any process on the local machine (or network, depending on binding) can potentially send commands to the listening Blender instance.

Operates as a plugin within the Claude Code ecosystem. Vulnerable to cascading risks if another compromised agent or plugin running in the same Claude environment issues malicious instructions to the Blender toolkit.