ClawHub
Back to skill

Security audit

IPdesign-3Dprint

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with its 3D-printing purpose, but it uses API credentials and Blender automation in ways that need review before running.

Review before installing. Run the Blender scripts only in a fresh/background Blender session, expect generated files under /tmp/skullpanda_output, avoid sending confidential prompts or reference images to external providers, and use a restricted/low-quota API key rather than a broadly privileged key.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:70
Finding

API Key Exposed Through URL and Process Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The skill instructs the agent/user to send prompts and potentially sensitive reference data to an external Google API using curl, creating an external data transmission path. While this appears intended for legitimate image generation, it can expose proprietary prompts, uploaded images, or confidential design material to a third-party service, especially because the workflow defaults to API-based generation when local options are unavailable.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

bash
# Using Gemini/Imagen 4.0 (API-only mode)
curl -X POST "https://generativelanguage.googleapis.com/v1beta/models/imagen-4.0-generate-001:predict?key=$GEMINI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "instances": [{"prompt": "Skullpanda-style character, front view..."}],

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script immediately selects and deletes all objects in the current Blender scene and removes all materials without confirmation. In a Blender automation context, this can destroy a user's open work or unsaved assets if the script is run in the wrong session, making it a real integrity and availability risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The overview states the skill is designed for "Pop Mart / Skullpanda-style collectible figures," which imposes a specific stylistic output by default rather than presenting it as an option the user can choose. Under the natural-language policy rule, this is a mild policy concern because the file does not clearly offer an opt-in or alternative style selection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The comment says 'NOT the base — keep separate for printing', which implies the base is excluded only from the joined figure mesh, not from output entirely. Later code explicitly exports the base as its own STL file, so this line can mislead readers about the actual printing/export behavior if interpreted as excluding the base from printing altogether.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script writes multiple files to /tmp and saves the current .blend file, STL exports, and a rendered preview without any explicit disclosure or consent step. While the destination is fixed and not obviously attacker-controlled, silent filesystem writes can leak artifacts, overwrite prior outputs, or surprise users in shared or automated environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.