ClawHub
Back to skill

Security audit

PrusaLink

Security checks for vulnerabilities and agentic risk

Overview

This PrusaLink printer-control skill is purpose-aligned, but it should be reviewed because it can control a physical printer and sends credentials/control traffic over HTTP by default.

Install only if you intend to let an agent control your PrusaLink printer. Prefer HTTPS, avoid API keys over HTTP, use a limited printer account if available, review any upload/start/cancel action before running it, and do not pass untrusted filenames or job IDs into the wrapper.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
run.sh:14
Finding

Authentication credentials and printer-control traffic use unencrypted HTTP by default

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
run.sh:113
Finding

Unvalidated URL path components can alter intended PrusaLink endpoints

Content
View full analysis
" curl_json -X DELETE "$BASE/api/v1/job/${ARGS[1]}" ;; ``` ```bash REMOTE_NAME="$(basename "$FILE")" OVERWRITE=0 PAAU=0 i=2 while [[ $i -lt ${#ARGS[@]} ]]; do case "${ARGS[$i]}" in --remote-name) REMOTE_NAME="${ARGS[$((i+1))]:-}"; i=$((i+2));; --overwrite) OVERWRITE=1; i=$((i+1));; --print-after-upload) PAAU=1; i=$((i+1));; *) die "unknown upload arg: ${ARGS[$i]}";; esac done headers=(-H "Content-Type: application/octet-stream") if [[ $OVERWRITE -eq 1 ]]; then headers+=(-H "Overwrite: ?1"); fi if [[ $PAAU -eq 1 ]]; then headers+=(-H "Print-After-Upload: ?1"); fi curl -sS --fail-with-body --max-time "$TIMEOUT" \ "${curl_auth_args[@]}" "${curl_header_args[@]}" \ "${headers[@]}" \ -X PUT --data-binary "@$FILE" \ "$BASE/api/v1/files/usb/$REMOTE_NAME" >/dev/null ``` ```bash start) [[ ${#ARGS[@]} -ge 2 ]] || die "start requires " curl_json -X POST "$BASE/api/v1/files/usb/${ARGS[1]}" >/dev/null echo "{\"started\": \"${ARGS[1]}\"}" ;; ``` ### Technical Analysis The `cancel` job ID, upload remote name, and `start` filename are directly concatenated into URLs. They are not validated as single path segments and are not percent-encoded. Characters such as `/`, `..`, `?`, and `#` can change how the URL is interpreted. A slash or traversal-like sequence can alter the path, a question mark can introduce a query string, and a fragment marker can cause following text not to be sent to the server. This means the final request can differ from the fixed resource operation represented by the command. Shell command injection is not present in these statements because the expanded URLs are quoted and passed as individual ` ...[truncated 1384 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
run.sh:151
Finding

User-controlled filenames are emitted as unescaped JSON

Content
View full analysis
" curl_json -X POST "$BASE/api/v1/files/usb/${ARGS[1]}" >/dev/null echo "{\"started\": \"${ARGS[1]}\"}" ;; ``` ### Technical Analysis `REMOTE_NAME` and `ARGS[1]` are controlled by command-line input and are inserted into JSON text without JSON-string escaping. Double quotes, backslashes, tabs, carriage returns, newlines, and other control characters can make the output invalid or alter its apparent structure. Shell command injection does not result from these particular `echo` statements because expansion occurs inside a quoted shell word. However, downstream software may treat the emitted text as trusted JSON and either fail to parse it or interpret attacker-injected properties. ### Attack Path 1. An attacker or untrusted caller supplies a crafted remote filename containing a quote, backslash, newline, or JSON syntax. 2. The upload or start request is processed using that value. 3. The Skill interpolates the value directly into its purported JSON response. 4. The resulting output is malformed or contains attacker-shaped JSON structure. 5. A downstream agent, log processor, or automation workflow misparses the result, accepts spoofed fields, or fails in a way that disrupts the workflow. ### Impact Assessment The direct impact is limited to output integrity and availability of downstream processing. Exploitation can spoof operation-result fields, inject additional apparent properties or log lines, and cause JSON parsers to reject the response. This issue does not directly grant operating-system privileges, execute shell commands, or expand printer permissions. Its practical scope depends on whether another component consumes this ou ...[truncated 36 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill exposes shell execution capability via a local run.sh wrapper but does not declare any tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and reviewability, because an agent may invoke shell-backed behavior without explicit declaration, increasing the chance of unintended command execution or misuse of environment-provided secrets during operation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The exposed command set includes state-changing operations like cancelling jobs, uploading files, and starting prints, but the described capability is framed mainly as a local status/upload/print wrapper and may not sufficiently emphasize destructive or safety-relevant actions. Understating actuator-like control can cause users or orchestrators to grant the skill broader trust than warranted, increasing the chance of unintended printer operation or job interruption.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · run.sh (reported line 148)May include surrounding context.

sh
if [[ $OVERWRITE -eq 1 ]]; then headers+=(-H "Overwrite: ?1"); fi
    if [[ $PAAU -eq 1 ]]; then headers+=(-H "Print-After-Upload: ?1"); fi

    curl -sS --fail-with-body --max-time "$TIMEOUT" \
      "${curl_auth_args[@]}" "${curl_header_args[@]}" \
      "${headers[@]}" \
      -X PUT --data-binary "@$FILE" \