ClawHub
Back to skill

Security audit

OpenClaw 3D Printing Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its 3D-printing purpose, but it deserves Review because setup and model execution grant broad local code execution with limited containment guidance.

Review this skill before installing. Use it in an isolated Python environment, avoid piping remote installer output directly into a shell unless you trust and verify the source, and only run CadQuery model scripts you created or reviewed because they are normal Python programs. I found no artifact-backed evidence of exfiltration, destructive behavior, credential theft, or hidden persistence.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
}

    try:
        proc = subprocess.run(
            [sys.executable, script_path],
            cwd=script_dir,
            capture_output=True,
Confidence
98% confidence
Finding
This code executes an arbitrary Python script path supplied on the command line using the current interpreter. In the context of an agent skill that processes user-provided CadQuery models, this is effectively arbitrary code execution with the privileges of the agent process, and the timeout does not prevent filesystem access, network access, or other side effects during execution.

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill instructs the agent to use local scripts, read a reference file, and potentially invoke CadQuery tooling, which implies shell and file-read capabilities despite no declared permissions. This creates a trust and sandboxing gap: an agent may execute repository scripts or access local files without explicit user awareness or policy review, increasing the chance of unsafe code execution or unintended data exposure.

Static analysis

No suspicious patterns detected.