blender-mcp@3.5.1
CAUTIONPublisher claims: "通过官方 Blender MCP Server 连接并操控运行中的 Blender：20+ 内置工具（场景分析、截图/渲染、导航、文档检索）加任意 bpy 代码执行；含 TCP 9876 协议细节、mcporter 用法、后台无头模式、故障排查。需要实时操控 Blender、查场景、跑脚本、截图渲染时使用。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry ClawHubPublisher taosiuman · joined 1 days agoInstalls 723Last detonated 25 h ago
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
CRITICAL
Pipe-to-shell patternREADME.md:90 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06CRITICAL
Pipe-to-shell patternSKILL.md:1053 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06CRITICAL
Pipe-to-shell patternREADME.md:268 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06MEDIUM
URL using raw IP addressSKILL.md:124 · URL using raw IP address — may bypass domain-based filtering
AST07MEDIUM
Remote installer piped to shellREADME.md:90 · Remote installer piped to shell
AST07HIGH
Outbound HTTP to raw IP addressSKILL.md:124 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07MEDIUM
Remote installer piped to shellSKILL.md:1053 · Remote installer piped to shell
AST07HIGH
Python subprocess execution detectedSKILL.md:359 · Python subprocess execution detected
AST05MEDIUM
Remote installer piped to shellREADME.md:268 · Remote installer piped to shell
AST07HIGH
File permission modification commandREADME.md:131 · File permission modification command — agent changes file ownership/permissions
AST05