ClawHub
Back to skill

Security audit

Bambu Lab 3D Printer

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate Bambu printer-control skill, but it needs review because it installs an unpinned global CLI and gives agents broad physical printer control.

Install only if you trust the @versatly/bambu package and are comfortable giving an agent local control of the printer. Prefer a pinned, audited version or isolated environment, protect the LAN access code and ~/.bambu/config.json, and require explicit user approval before heating, moving axes, deleting files, starting prints, calibration, or sending raw G-code.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code Snippet

markdown
- CLI: `@versatly/bambu` installed globally (`npm i -g @versatly/bambu`)

Technical Analysis

The skill directs users or agents to install @versatly/bambu globally from the npm registry without specifying an exact audited version or integrity value. Consequently, npm resolves whichever version is current at installation time, so the effective executable code can change after this skill has been reviewed.

npm packages may define lifecycle scripts that execute during installation with the privileges of the invoking user. Global installation also makes the resulting command broadly available in the user's environment. If the package, its maintainer account, one of its transitive dependencies, or the package-distribution channel is compromised, installation could execute attacker-controlled code.

The package source and manifest are not included in the audited project, so this audit cannot verify its lifecycle scripts, transitive dependencies, credential handling, or runtime behavior. This finding identifies supply-chain exposure rather than asserting that the named package is currently malicious.

Attack Path

  1. A user or agent follows the prerequisite in SKILL.md.
  2. It runs npm i -g @versatly/bambu without a version constraint or locked dependency graph.
  3. npm retrieves the package version and transitive dependencies available at that time.
  4. A compromised release or dependency executes malicious lifecycle code during installation or malicious code when the bambu command is invoked.
  5. The code executes with the invoking user's privileges.
  6. It may access user-readable files, network resources, and the printer configuration stored at ~/.bambu/config.json, including the LAN printer credential described by the skill.

Impact Assessme

...[truncated 740 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact version that has undergone security review, rather than relying on the latest registry release:
    bash
    npm install --save-exact @versatly/bambu@X.Y.Z
  2. Prefer a project-local installation backed by a committed lockfile instead of a global installation.
  3. Verify package provenance, publisher identity, release signatures or attestations, and npm integrity metadata before installation.
  4. Audit the package's lifecycle scripts and transitive dependency tree. Where compatible with the package, install with lifecycle scripts disabled:
    bash
    npm install --ignore-scripts
  5. Run the CLI under a dedicated, least-privileged account with access limited to the printer and required files.
  6. Protect ~/.bambu/config.json with restrictive filesystem permissions and avoid exposing its contents in logs or command output.
  7. Document a trusted source and reproducible installation process so that future installations use the same audited artifact.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Instruction Override

High
Category
Prompt Injection
Confidence
70% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
## Prerequisites

- Printer must be in **Developer Mode** (Settings → LAN Only → Enable Developer Mode)
- Need: IP address, serial number, LAN access code (from printer touchscreen)
- CLI: `@versatly/bambu` installed globally (`npm i -g @versatly/bambu`)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
75% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md
| Issue | Fix |
|-------|-----|
| Connection timeout | Developer Mode enabled? Correct IP? Printer on? |
| Auth failed | Check LAN access code (it changes if you re-enable Developer Mode) |
| FTP error | Port 990, implicit TLS. Printer must be in LAN mode. |
| No AMS data | AMS connected and detected? Check printer touchscreen. |

Instruction Override

High
Category
Prompt Injection
Confidence
70% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

md
| Issue | Fix |
|-------|-----|
| Connection timeout | Developer Mode enabled? Correct IP? Printer on? |
| Auth failed | Check LAN access code (it changes if you re-enable Developer Mode) |
| FTP error | Port 990, implicit TLS. Printer must be in LAN mode. |
| No AMS data | AMS connected and detected? Check printer touchscreen. |
| MQTT drops | WiFi signal weak? Check `bambu status` for wifi_signal field. |

Static analysis

No suspicious patterns detected.