OpenClaw 3D Printing Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:15 AM UTC
• Version: 1.0.1

Overview

The skill appears to be a real 3D-printing CAD helper, but its install instructions and model runner expose users to unnecessary code-execution risk.

Install only if you are comfortable reviewing and replacing the micromamba install steps with a verified package-manager or checksum-validated flow. Treat any CadQuery model file as executable code: run only models you generated or trust, preferably in a disposable virtual environment/container without secrets or broad filesystem access.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:56

Finding

Unverified Remote Installer Piped Directly into Bash

Content

View full analysis

Remediation

View remediation

//micromamba-linux-aarch64.tar.bz2" echo " micromamba.tar.bz2" | sha256sum --check # Extract and install only after successful verification. ``` The exact authoritative URL, version, checksum, and extraction command should be obtained from the official Micromamba release documentation and reviewed before publication. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/run_cadquery_model.py:95

Finding

CadQuery Model Runner Executes Supplied Python Without Isolation

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: references/requirements.txt:4

Finding

Third-Party Dependencies Are Not Exactly Pinned or Integrity-Verified

Content

View full analysis

=2.6.1,<3 trimesh>=4,<5 pyrender>=0.1.45,<0.2 Pillow>=10,<13 numpy>=1.24,<3 lxml>=4.9,<7 ``` ### Technical Analysis The dependency manifest uses broad version ranges and does not provide distribution hashes. The listed package names appear legitimate and no typosquatted package was identified, but the installation is not reproducible: package resolution can select versions published after the Skill was audited. This creates a supply-chain exposure because new releases within the accepted ranges can introduce compromised installation code, vulnerable transitive dependencies, or incompatible behavior. The documented `pip install -r references/requirements.txt` procedure therefore does not ensure that users install the same artifacts reviewed and tested by the maintainer. ### Attack Path 1. A malicious or compromised package release is published under one of the accepted package names and within its permitted version range, or an unsafe transitive dependency becomes resolvable. 2. A user follows the README and runs: ```bash python -m pip install -r references/requirements.txt ``` 3. The package resolver selects the new, unreviewed release. 4. Package installation or later import executes compromised code in the Skill's Python environment. 5. The compromised dependency gains the permissions of the user running the installation or Skill. ### Impact Assessment If an accepted package or transitive dependency is compromised, malicious code could execute during installation or import with the invoking user's privileges. Potential impact includes access to project data, environment variables, local credentials, generated models, and available network resources. This finding represents a potential supply-chain path rather than evidenc ...[truncated 57 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

curl -L micro.mamba.pm/install.sh | bash executes a remote script directly in the user's shell without prior inspection or integrity verification. If the remote host, network path, DNS, or served script is compromised, this can result in arbitrary code execution during installation.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

bash

git clone https://github.com/antoniosilveira/openclaw-3d-printing-skill.git ~/.openclaw/workspace/skills/openclaw-3d-printing-skill
cd /tmp
curl -L micro.mamba.pm/install.sh | bash
source ~/.bashrc
micromamba create -n cadquery312 -c conda-forge python=3.12 cadquery -y
micromamba activate cadquery312

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The | bash pipeline is dangerous because it chains network retrieval directly into command execution, eliminating opportunities for user review and validation. In installation documentation, this pattern materially increases the risk of silent arbitrary code execution from a compromised source.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

bash

git clone https://github.com/antoniosilveira/openclaw-3d-printing-skill.git ~/.openclaw/workspace/skills/openclaw-3d-printing-skill
cd /tmp
curl -L micro.mamba.pm/install.sh | bash
source ~/.bashrc
micromamba create -n cadquery312 -c conda-forge python=3.12 cadquery -y
micromamba activate cadquery312

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The README repeats a direct remote-script execution pattern for installing micromamba. This exposes users to arbitrary code execution if the fetched installer is tampered with or if transport/trust assumptions fail.

Content

Scanner excerpt · README.md (reported line 167)May include surrounding context.

bash

cd /tmp
curl -L micro.mamba.pm/install.sh | bash
source ~/.bashrc

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

This repeated | bash usage has the same risk profile: direct execution of untrusted remote content with no verification barrier. Because this is a README likely to be copied verbatim by users, the pattern is practically exploitable if the upstream script delivery is compromised.

Content

Scanner excerpt · README.md (reported line 167)May include surrounding context.

bash

cd /tmp
curl -L micro.mamba.pm/install.sh | bash
source ~/.bashrc

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description emphasizes generating parametric, 3D-printable mechanical parts and enclosures with CadQuery, along with design iteration and preview rendering. The supplied code does none of that: it only accepts existing STL files, loads them via a mesh I/O helper, and exports them to 3MF. This is a materially different primary purpose. While STL/3MF are mentioned in the declaration, the code specifically operates on existing meshes, which the description explicitly says should not be the use case ('Do not use for ... editing an existing mesh without rebuilding it parametrically'). Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 58)May include surrounding context.

cd /tmp curl -L micro.mamba.pm/install.sh | bash source ~/.bashrc micromamba create -n cadquery312 -c conda-forge python=3.12 cadquery -y micromamba activate cadquery312 python -m pip install -r ~/.openclaw/workspace/skills/openclaw-3d-printing-skill/references/requirements.txt

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 119)May include surrounding context.

brew install python@3.12

text

Create a project-local environment and install dependencies:

```bash
cd ~/.openclaw/workspace/skills/openclaw-3d-printing-skill

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 171)May include surrounding context.

source ~/.bashrc

text

Create the environment:

```bash
micromamba create -n cadquery312 -c conda-forge python=3.12 cadquery -y

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs use of local scripts and shell-capable workflows (scripts/run_cadquery_model.py, preview generation, file conversion) but declares no explicit tool scope or permissions boundary. That creates unnecessary privilege ambiguity: an agent may invoke file, environment, or shell capabilities more broadly than intended, increasing risk of unintended file access or command execution in the host environment.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 94% confidence

Finding

This script directly executes a user-supplied Python file with the current interpreter via subprocess.run([sys.executable, script_path]). In the context of a 3D-printing/CadQuery skill, model scripts are effectively untrusted code, so this enables arbitrary code execution with the privileges of the agent process, including file access, network access, and local process execution.

Content

Scanner excerpt · scripts/run_cadquery_model.py (reported line 95)May include surrounding context.

python

}

    try:
        proc = subprocess.run(
            [sys.executable, script_path],
            cwd=script_dir,
            capture_output=True,

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file contains a runnable test snippet that exports test_box.stl, which writes a file to the current working directory. The surrounding text explains how to run it, but does not explicitly warn the user that the command creates a local artifact or advise choosing a safe directory/name to avoid accidental overwrite.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: lxml has 14 known advisory(ies) (CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +11 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.