Bambu Studio Ai

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:21 AM UTC
• Version: 1.0.1

Overview

This appears to be a genuine Bambu Lab 3D-printer automation skill, but it needs Review because it combines printer control and credential handling with under-scoped monitoring and unsafe data-handling patterns.

Install only if you are comfortable giving the skill control over a real printer and access to printer credentials. Prefer manual print mode, avoid raw G-code unless you know exactly what it does, do not enable auto-pause or background monitoring without an explicit opt-in, avoid untrusted image URLs, and consider isolating the environment and pinning dependencies before use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate.py:224

Finding

Unrestricted Image URL Fetching Enables Server-Side Request Forgery and Data Relay

Content

View full analysis

Remediation

View remediation

MAX_IMAGE_BYTES: raise ValueError("Image exceeds maximum size") output.write(chunk) ``` 6. Require an image MIME type and validate magic bytes before further processing. 7. Obtain explicit confirmation before uploading a locally fetched image to a third-party provider. 8. Use network egress controls to prevent the generation process from reaching localhost, cloud metadata services, and printer-management subnets. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/bambu.py:244

Finding

Predictable Shared Temporary Credential File Exposes the Printer Access Code

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/monitor.py:63

Finding

Printer Access Code Is Exposed in ffmpeg Process Arguments

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:512

Finding

Skill Directs Background Printer Monitoring Without Prior Explicit Consent

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Runtime Dependencies Are Installed Without a Reproducible Hash-Locked Dependency Set

Content

View full analysis

=2.6,<3.0 bambu-lab-cloud-api>=1.0,<2.0 cryptography>=42.0 paho-mqtt>=2.0 trimesh>=4.10,<5.0 requests>=2.31,<3.0 numpy>=1.24 Pillow>=9.0 ddgs>=7.0 pygltflib scipy>=1.10 manifold3d>=3.0 ``` ### Technical Analysis Installation does not use: - Exact versions for every transitive and direct dependency. - Cryptographic package hashes. - A generated lock file. - A private or explicitly trusted package index. - Reproducible dependency resolution. The `SKILL.md` installer is especially broad because it lists only package names. It can install whatever version is latest when the skill is activated, independently of the reviewed `requirements.txt`. These dependencies execute with the same account privileges as the skill and include packages that process untrusted media, connect to printers, handle cryptographic material, and perform network requests. A compromised future release, malicious transitive dependency, or account takeover could therefore turn installation or import into arbitrary code execution. No evidence in the audited repository shows that any currently named package is malicious. The confirmed issue is the absence of integrity controls and reproducible resolution. ### Attack Path 1. A package maintainer account or package distribution channel is compromised, or a vulne ...[truncated 1019 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (163)

Tainted flow: 'API_KEY' from os.environ.get (line 72, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate.py (reported line 390)May include surrounding context.

python

def _upload_image(self, path):
        """Upload local image and return URL."""
        with open(path, "rb") as f:
            r = requests.post(f"{self.BASE}/openapi/v1/files",
                headers={"Authorization": f"Bearer {API_KEY}"},
                files={"file": f}
            )

Tainted flow: 'API_KEY' from os.environ.get (line 72, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate.py (reported line 442)May include surrounding context.

python

if not image_path.startswith("http"):
            # Upload first
            with open(image_path, "rb") as f:
                r = requests.post(f"{self.BASE}/upload",
                    headers={"Authorization": f"Bearer {API_KEY}"},
                    files={"file": f}
                )

Tainted flow: 'API_KEY' from os.environ.get (line 72, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate.py (reported line 504)May include surrounding context.

python

json={"image_url": image_path, "prompt": prompt})
        else:
            with open(image_path, "rb") as f:
                r = requests.post(f"{self.BASE}/api/generate",
                    headers={"X-API-Key": API_KEY},
                    files={"image": f},
                    data={"prompt": prompt})

Tainted flow: 'API_KEY' from os.environ.get (line 72, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate.py (reported line 554)May include surrounding context.

python

json={"image_url": image_path, "type": "image-to-3d"})
        else:
            with open(image_path, "rb") as f:
                r = requests.post(f"{self.BASE}/v1/generate",
                    headers={"Authorization": f"Bearer {API_KEY}"},
                    files={"image": f})
        r.raise_for_status()

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description and body advertise or imply a very broad operational surface, including direct printer control, raw G-code transmission, snapshot capture, monitoring, and credential-backed cloud/LAN operations, but these capabilities are not crisply bounded or consistently declared. In security terms, that mismatch obscures the real attack surface and can mislead reviewers or users about what the skill may actually do.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.