Find Stl

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:47 AM UTC
• Version: 0.1.0

Overview

The skill appears to be a legitimate Printables downloader, but its file-saving code can be tricked by remote filenames into writing outside the intended download folder.

Use Review caution before installing. The skill's purpose is understandable, but downloads should be treated as untrusted; run fetches only into a scratch directory and fix filename/path containment before relying on it for normal use. Search requests are sent to Printables.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/find_stl.py:187

Finding

Path Traversal Through Untrusted Remote Model Filename

Content

View full analysis

Vulnerability Details

File Location: scripts/find_stl.py, lines 187-191; file-write sink at lines 111-120
Vulnerability Type: Path traversal leading to arbitrary file creation or overwrite
Risk Level: High

Vulnerable Code

python

for fobj in stls:
    fid = str(fobj["id"])
    name = fobj.get("name") or f"file-{fid}"
    link = printables_get_download_link(p["id"], "stl", [fid])
    out_path = os.path.join(base_dir, "files", name)
    download_file(link, out_path)

The resulting path reaches the following file-write sink:

python

def download_file(url: str, out_path: str, timeout: int = 60) -> None:
    os.makedirs(os.path.dirname(out_path), exist_ok=True)
    req = urllib.request.Request(url, headers={"user-agent": "Mozilla/5.0"})
    with urllib.request.urlopen(req, timeout=timeout) as r:
        with open(out_path, "wb") as f:
            while True:
                b = r.read(1024 * 1024)
                if not b:
                    break
                f.write(b)

Technical Analysis

The name value is obtained from remotely supplied Printables model metadata and is passed directly to os.path.join() without filename sanitization, path normalization, or destination containment validation.

os.path.join(base_dir, "files", name) does not guarantee that the result remains inside the intended download directory. A filename containing parent-directory components such as ../../target can escape that directory. On supported platforms, an absolute filename can also cause the preceding path components to be discarded.

The calculated path is passed to download_file(), which creates parent directories and opens the destination in wb mode. Consequently, an escaped destination is created or overwritten without confirmation. The safe_slug() protection applied to the model directory does not protect individual remote filenames.

Attack Path

1. An attac ...[truncated 1628 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat every remote filename as untrusted. Reject absolute paths, parent-directory components, path separators, NUL characters, and platform-specific drive or UNC path syntax.
2. Reduce the remote value to a safe filename using a strict allowlist or a sanitized basename. Generate a local filename from the trusted file ID when the supplied name is invalid.
3. Resolve both the destination root and candidate path to canonical absolute paths, then verify containment before creating directories or opening the file.
4. Refuse duplicate destinations and existing files by default. Require an explicit overwrite option if replacement is intended.
5. Open newly downloaded files with exclusive creation mode where practical to reduce unintended overwrites and race conditions.
6. Add tests covering ../, nested traversal, absolute paths, Windows drive paths, UNC paths, mixed separators, empty names, and duplicate sanitized names.

Example containment pattern:

python

files_dir = os.path.realpath(os.path.join(base_dir, "files"))
os.makedirs(files_dir, exist_ok=True)

remote_name = fobj.get("name") or f"file-{fid}"
safe_name = os.path.basename(remote_name.replace("\\", "/"))

if not safe_name or safe_name in {".", ".."}:
    safe_name = f"file-{fid}"

out_path = os.path.realpath(os.path.join(files_dir, safe_name))
if os.path.commonpath([files_dir, out_path]) != files_dir:
    raise RuntimeError(f"Unsafe remote filename: {remote_name!r}")

if os.path.exists(out_path):
    raise RuntimeError(f"Refusing to overwrite existing file: {out_path}")

download_file(link, out_path)

For stronger isolation, derive the local filename entirely from the trusted file ID and retain the original remote filename only as metadata in manifest.json.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes a Python script that performs network access to Printables and writes downloaded files plus a manifest to disk, but the skill metadata does not declare any tool scope such as permissions or allowed-tools. That creates an authorization gap: an agent or runtime may permit broader execution than intended, making external downloads and filesystem writes less visible to policy enforcement and review.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/find_stl.py (reported line 34)May include surrounding context.

python

import zipfile
from typing import Any, Dict, List, Optional, Tuple

PRINTABLES_GQL = "https://api.printables.com/graphql/"


def http_json(url: str, payload: Dict[str, Any], timeout: int = 30) -> Dict[str, Any]:

Static analysis

No suspicious patterns detected.