SLOHERO · RELEASE CHECK · 26 SEPTEMBER 2026

Cloth Lab v0.7
Release security checks

No threats detected by the completed scans; the checks listed below passed. This is a maintainer release check, not independent security certification.

This is an English companion to the existing report. It describes the same release and checks; translating the page did not modify or rescan the add-on.

Malware scans

VirusTotal: 0 detections from 65 engines reporting undetected. Nine engines did not support the file type and one failed. Only the already-public installer ZIP was submitted. Result recorded at 2026-09-26T04:31:24.298Z. View the VirusTotal result.

Microsoft Defender: no threats found in the ZIPs, extracted contents and downloadable examples. Signature version 1.459.407.0. Custom scans ignored exclusions and ran with remediation disabled.

Package and source review

22 installer entries, including 15 Python files (4,304 lines). No native executables or encrypted ZIP entries. Archive paths and CRC checks passed, and the published source matches the installed add-on files.

• No addon network client or external process launch identified.
• No pip/install/dependency downloader identified.
• sys.modules is used only to access this package.
• Preset loading uses JSON and an allowlist of settings; no eval/exec.
• File IO is limited to bundled/native Blender asset loading and user-invoked image/asset loading, export, render and bake.
• Blender import machinery creates normal Python bytecode caches.
• Source ZIP includes developer tests and build scripts that do not run when installing the addon.

Blender assets and runtime checks

Six .blend files were inspected, including the bundled reference. No automatic script texts, complex Python drivers, script nodes, linked libraries or unpacked external images were found. The reference contains simple strength drivers and non-executable instructions/JSON.

Tests used separate Blender user/configuration directories on the same Windows host, with offline mode and automatic .blend scripts disabled. They covered installation, enabling, basic cloth creation, user-requested asset operations, restart, disabling, re-enabling and removal. The 5.2 run also checked self-collision example playback.

• Blender 4.5.14 LTS · install: all listed checks passed
• Blender 4.5.14 LTS · restart: all listed checks passed
• Blender 5.2.2 LTS · install: all listed checks passed
• Blender 5.2.2 LTS · restart: all listed checks passed

No add-on network or process actions were observed by the Python audit hooks. These hooks are not OS-wide monitoring.

Limits of these checks

• No separate freshly installed Windows VM was available; new Blender user/config directories on this Windows host were used.
• No macOS/Linux or enterprise endpoint policy validation.
• Python audit hooks do not capture every native operation; not an OS-wide network/system-call trace.
• Chrome/Edge reputation warnings were not independently certified; successful downloading does not prove absence of future warnings.
• Undetected does not guarantee absence of every vulnerability or future detection. SHA-256 confirms byte identity, not safety.
• VirusTotal result is for the install ZIP. Unsupported/failed engines are not counted as passed.

Release file identity

Download SHA-256 checksums · Full machine-readable report

Back to downloads →