ClawHub
Back to skill

Security audit

image-to-3d-part-stl

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed image-to-STL generation helper with ordinary local file generation and dependency-install behavior, but its Python dependencies should be pinned before use in stricter environments.

Install only in a project-local virtual environment, review or pin the Python dependency versions if reproducibility matters, and keep generated SVG/STL work in the current project directory. Confirm the SVG blueprint before allowing the STL-generation step, as the skill itself recommends.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
trimesh
shapely
mapbox_earcut
Confidence
96% confidence
Finding
The dependency is specified without a version pin, which makes builds non-reproducible and can cause the skill to install newly released upstream packages with unexpected breaking changes or security regressions. In a supply-chain context, unpinned dependencies increase exposure to malicious or compromised releases because the resolved version can change over time.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
trimesh
shapely
mapbox_earcut
Confidence
96% confidence
Finding
The dependency is unpinned, so installs are not deterministic and may pull different trimesh versions over time. This increases supply-chain risk and can introduce vulnerable or incompatible versions without any code changes in the skill itself.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
trimesh
shapely
mapbox_earcut
Confidence
96% confidence
Finding
Leaving shapely unpinned allows the installed version to drift as upstream releases change, which weakens reproducibility and raises the chance of unintentionally consuming a vulnerable or malicious package release. This is a classic software supply-chain hygiene issue rather than an immediate exploit by itself.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
trimesh
shapely
mapbox_earcut
Confidence
96% confidence
Finding
An unpinned mapbox_earcut dependency means future installations may resolve to different package versions, creating avoidable supply-chain and stability risk. While not directly exploitable alone, it reduces control over what code is installed and executed in the environment.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
78% confidence
Finding
The file depends on numpy without any version constraint, and static analysis indicates multiple known advisories affecting some numpy releases. Because no version is pinned, the skill may install a vulnerable version depending on environment and resolver behavior, making this a real dependency risk even though exploitability depends on the specific version actually resolved and how the library is used.

Static analysis

No suspicious patterns detected.