ClawHub
Back to skill

Security audit

Kiln

Security checks across malware telemetry and agentic risk

Overview

Kiln is a disclosed 3D-printer control skill, but it gives agents broad authority over physical machines with autonomy and camera features that need careful human supervision.

Install only if you are comfortable letting an agent control real 3D printers. Keep the printer supervised, require explicit approval before heating, printing, canceling, ordering fulfillment, or sending G-code, limit printer/API credentials to the minimum needed, and disable camera, webhooks, cloud sync, plugins, or self-update paths unless you intentionally use them. VirusTotal and static scan were clean, so the Review verdict is based on scope and safety disclosure, not malware evidence.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README prominently markets autonomous end-to-end control of real 3D printers by AI agents with 'no human in the middle' before giving any strong upfront safety warning. For a system that drives physical machinery with heaters, motors, and potential fire/mechanical hazards, this framing can encourage unsafe deployment and over-trust by users or agents.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill description includes camera snapshot monitoring and failure detection but does not warn that images from printer environments may capture people, homes, workplaces, or sensitive objects and may be transmitted to external systems or models. Because this is an agent-oriented skill with remote monitoring features, missing privacy disclosure and consent guidance creates meaningful risk of unintended visual-data collection and exposure.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill description includes camera snapshot monitoring and failure detection but does not warn that images from printer environments may capture people, homes, workplaces, or sensitive objects and may be transmitted to external systems or models. Because this is an agent-oriented skill with remote monitoring features, missing privacy disclosure and consent guidance creates meaningful risk of unintended visual-data collection and exposure.

Self-Modification

High
Category
Rogue Agent
Content
That's the whole happy path. Your AI does the designing, slicing, and printing — you never touch a CLI. OS-specific walkthrough (Windows, WSL 2, Linux) at **[kiln3d.com/install](https://kiln3d.com/install)**.

> [!TIP]
> `kiln doctor` checks your whole setup and tells you exactly what to fix. `kiln self-update` upgrades in place when a new release lands.

<details>
<summary><strong>Prefer to drive it yourself? (CLI tour)</strong></summary>
Confidence
78% confidence
Finding
self-update

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.