3dgs Engineering Guide

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 1.0.6

Overview

This is a Markdown guide for 3D Gaussian Splatting engineering workflows, with some user-run package commands that should be pinned but no hidden or automatic unsafe behavior.

Before following the documented package commands, pin exact package versions, prefer local project dependencies with lockfiles over global installs or ad hoc npx execution, and run conversion tooling in a minimally privileged environment. The skill does not itself run code or request credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:174
• Finding: Unpinned Python Package Installation## Vulnerability Details **File Location**: `SKILL.md:174` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Complete Code Snippet**: ```markdown **Software**: COLMAP (SfM+MVS standard), ORB-SLAM3/BLEPS (visual SLAM), LIO-SAM/FAST-LIO2 (LiDAR SLAM), FreeMoCap (AGPL-3.0, markerless MoCap from webcams, outputs .trc/.c3d/.fbx, `pip install freemocap`) ``` ### Technical Analysis The documented command installs `freemocap` without pinning an exact version or verifying package integrity. Package registry resolution is mutable, so users executing this command may receive a release that did not exist when the Skill was reviewed. Python package installation can execute package-controlled build hooks or installation logic. This is a supply-chain weakness rather than evidence that the current `freemocap` package is malicious. Exploitation depends on compromise or takeover of the package, its publishing account, the registry, or a transitive dependency. ### Attack Path 1. An attacker compromises the package, a maintainer account, or a transitive dependency and publishes a malicious release. 2. A user follows the Skill guidance and runs `pip install freemocap`. 3. `pip` resolves the current mutable release rather than a previously reviewed version. 4. Malicious build or installation logic executes under the privileges of the user running `pip`. 5. The payload can access resources available to that user and may install additional components. ### Impact Assessment Successful exploitation could execute arbitrary code with the invoking user's privileges. The accessible scope may include user-owned files, project data, environment variables, network credentials available to the process, and writable Python environments. Administrator-level impact would require the user to run the command with elevated privileges; the Skill does not explicitly instruct elevation.
• Remediation: ## Remediation Suggestions - Pin `freemocap` to an explicitly reviewed version. - Install it inside a dedicated virtual environment rather than into a shared interpreter. - Provide a lockfile or constraints file with cryptographic hashes and install with `pip --require-hashes`. - Document the expected official package registry and project source. - Review direct and transitive dependencies before updating the pinned version. - Avoid running package installation with administrator or root privileges.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:209
• Finding: Unpinned Global npm Package Installation## Vulnerability Details **File Location**: `SKILL.md:209` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Complete Code Snippet**: ```markdown **Toolchain**: **splat-transform** (PlayCanvas, MIT, CLI) — PLY→SOG (~20x), PLY→streamed SOG (LOD), `-K` collision mesh (`.collision.glb`); `npm install -g @playcanvas/splat-transform` ``` ### Technical Analysis The command globally installs the current release of `@playcanvas/splat-transform` without an exact version, lockfile, or integrity verification. npm packages can define lifecycle scripts that execute during installation. Global installation also places package files and executable shims into shared user-level or system-level tool locations, increasing the consequences of a compromised release. There is no evidence in the audited file that the named package is currently malicious. The vulnerability is the unsafe, mutable installation pattern. ### Attack Path 1. An attacker compromises the package namespace, publisher account, registry delivery path, or a dependency. 2. The attacker publishes a release containing a malicious lifecycle script or executable. 3. A user runs the documented `npm install -g @playcanvas/splat-transform` command. 4. npm retrieves the unreviewed current release and may execute its lifecycle scripts. 5. The package can modify globally writable command shims or other resources accessible to the invoking account. ### Impact Assessment Exploitation could provide arbitrary code execution with the invoking user's privileges and could tamper with user-level global npm tools. If the global prefix is system-owned and the user independently executes the command with elevated privileges, system-wide files or command installations could be affected. The Skill itself does not request elevated privileges.
• Remediation: ## Remediation Suggestions - Pin the package to a reviewed exact version. - Prefer a project-local development dependency governed by a committed lockfile instead of global installation. - Invoke the locally installed binary through a package script. - Verify package provenance, publisher identity, integrity metadata, and dependency changes before upgrades. - Disable npm lifecycle scripts where compatible with the package and workflow. - Do not run the installation as root or through an elevated shell.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:273
• Finding: Unpinned Package Retrieval and Immediate Execution Through npx## Vulnerability Details **File Location**: `SKILL.md:273` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Complete Code Snippet**: ```bash npx glb-to-navmesh scene.collision.glb navmesh.bin ``` ### Technical Analysis The pipeline invokes `glb-to-navmesh` through `npx` without an exact version or a requirement that the executable already be installed from a locked local dependency set. Depending on the npm/npx version and local environment, `npx` may retrieve a missing package from the configured registry and immediately execute it. This combines acquisition and execution of a mutable third-party payload without an intervening review step. No evidence establishes that `glb-to-navmesh` is malicious. The risk arises if the package, publisher, registry configuration, or dependency chain is compromised. ### Attack Path 1. The expected executable is not installed locally, or registry resolution takes precedence under the user's configuration. 2. An attacker compromises the package or its dependency chain and publishes malicious code. 3. A user executes the documented `npx glb-to-navmesh scene.collision.glb navmesh.bin` command. 4. `npx` retrieves the mutable package release from the configured registry. 5. The downloaded package executes immediately and can access the working directory, input scene file, process environment, filesystem resources, and network services available to the user. ### Impact Assessment Successful exploitation could result in arbitrary code execution under the invoking account. The payload could read or alter project assets, replace the generated `navmesh.bin`, access user-readable data and environment variables, or initiate network connections. Higher privileges would only be obtained if the user independently runs the command from an elevated environment.
• Remediation: ## Remediation Suggestions - Add `glb-to-navmesh` as a project-local dependency at a reviewed exact version. - Commit and enforce the corresponding package lockfile. - Invoke the locked local executable through an npm script rather than allowing implicit retrieval. - If one-off execution is unavoidable, specify an exact reviewed version and use the expected registry explicitly. - Use npm integrity verification and audit the package and transitive dependency tree. - Run the conversion in a minimally privileged, network-restricted environment with access limited to required input and output files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill instructs users to run `npx glb-to-navmesh` without pinning a package version or source, which allows the latest published package to be fetched and executed at runtime. If the package is compromised, typo-squatted, or updated maliciously, this becomes a supply-chain execution vector on the user's machine.

Static analysis

No suspicious patterns detected.