3dgs Engineering Guide

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 1.0.6

Overview

This is a Markdown guide for 3D Gaussian Splatting engineering workflows, with some user-run package commands that should be pinned but no hidden or automatic unsafe behavior.

Before following the documented package commands, pin exact package versions, prefer local project dependencies with lockfiles over global installs or ad hoc npx execution, and run conversion tooling in a minimally privileged environment. The skill does not itself run code or request credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:174

Finding

Unpinned Python Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:174
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

markdown

**Software**: COLMAP (SfM+MVS standard), ORB-SLAM3/BLEPS (visual SLAM), LIO-SAM/FAST-LIO2 (LiDAR SLAM), FreeMoCap (AGPL-3.0, markerless MoCap from webcams, outputs .trc/.c3d/.fbx, `pip install freemocap`)

Technical Analysis

The documented command installs freemocap without pinning an exact version or verifying package integrity. Package registry resolution is mutable, so users executing this command may receive a release that did not exist when the Skill was reviewed. Python package installation can execute package-controlled build hooks or installation logic.

This is a supply-chain weakness rather than evidence that the current freemocap package is malicious. Exploitation depends on compromise or takeover of the package, its publishing account, the registry, or a transitive dependency.

Attack Path

1. An attacker compromises the package, a maintainer account, or a transitive dependency and publishes a malicious release.
2. A user follows the Skill guidance and runs pip install freemocap.
3. pip resolves the current mutable release rather than a previously reviewed version.
4. Malicious build or installation logic executes under the privileges of the user running pip.
5. The payload can access resources available to that user and may install additional components.

Impact Assessment

Successful exploitation could execute arbitrary code with the invoking user's privileges. The accessible scope may include user-owned files, project data, environment variables, network credentials available to the process, and writable Python environments. Administrator-level impact would require the user to run the command with elevated privileges; the Skill does not explicitly instruct elevation.

Remediation

View remediation

Remediation Suggestions

• Pin freemocap to an explicitly reviewed version.
• Install it inside a dedicated virtual environment rather than into a shared interpreter.
• Provide a lockfile or constraints file with cryptographic hashes and install with pip --require-hashes.
• Document the expected official package registry and project source.
• Review direct and transitive dependencies before updating the pinned version.
• Avoid running package installation with administrator or root privileges.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:209

Finding

Unpinned Global npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:209
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

markdown

**Toolchain**: **splat-transform** (PlayCanvas, MIT, CLI) — PLY→SOG (~20x), PLY→streamed SOG (LOD), `-K` collision mesh (`.collision.glb`); `npm install -g @playcanvas/splat-transform`

Technical Analysis

The command globally installs the current release of @playcanvas/splat-transform without an exact version, lockfile, or integrity verification. npm packages can define lifecycle scripts that execute during installation. Global installation also places package files and executable shims into shared user-level or system-level tool locations, increasing the consequences of a compromised release.

There is no evidence in the audited file that the named package is currently malicious. The vulnerability is the unsafe, mutable installation pattern.

Attack Path

1. An attacker compromises the package namespace, publisher account, registry delivery path, or a dependency.
2. The attacker publishes a release containing a malicious lifecycle script or executable.
3. A user runs the documented npm install -g @playcanvas/splat-transform command.
4. npm retrieves the unreviewed current release and may execute its lifecycle scripts.
5. The package can modify globally writable command shims or other resources accessible to the invoking account.

Impact Assessment

Exploitation could provide arbitrary code execution with the invoking user's privileges and could tamper with user-level global npm tools. If the global prefix is system-owned and the user independently executes the command with elevated privileges, system-wide files or command installations could be affected. The Skill itself does not request elevated privileges.

Remediation

View remediation

Remediation Suggestions

• Pin the package to a reviewed exact version.
• Prefer a project-local development dependency governed by a committed lockfile instead of global installation.
• Invoke the locally installed binary through a package script.
• Verify package provenance, publisher identity, integrity metadata, and dependency changes before upgrades.
• Disable npm lifecycle scripts where compatible with the package and workflow.
• Do not run the installation as root or through an elevated shell.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:273

Finding

Unpinned Package Retrieval and Immediate Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:273
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash

npx glb-to-navmesh scene.collision.glb navmesh.bin

Technical Analysis

The pipeline invokes glb-to-navmesh through npx without an exact version or a requirement that the executable already be installed from a locked local dependency set. Depending on the npm/npx version and local environment, npx may retrieve a missing package from the configured registry and immediately execute it. This combines acquisition and execution of a mutable third-party payload without an intervening review step.

No evidence establishes that glb-to-navmesh is malicious. The risk arises if the package, publisher, registry configuration, or dependency chain is compromised.

Attack Path

1. The expected executable is not installed locally, or registry resolution takes precedence under the user's configuration.
2. An attacker compromises the package or its dependency chain and publishes malicious code.
3. A user executes the documented npx glb-to-navmesh scene.collision.glb navmesh.bin command.
4. npx retrieves the mutable package release from the configured registry.
5. The downloaded package executes immediately and can access the working directory, input scene file, process environment, filesystem resources, and network services available to the user.

Impact Assessment

Successful exploitation could result in arbitrary code execution under the invoking account. The payload could read or alter project assets, replace the generated navmesh.bin, access user-readable data and environment variables, or initiate network connections. Higher privileges would only be obtained if the user independently runs the command from an elevated environment.

Remediation

View remediation

Remediation Suggestions

• Add glb-to-navmesh as a project-local dependency at a reviewed exact version.
• Commit and enforce the corresponding package lockfile.
• Invoke the locked local executable through an npm script rather than allowing implicit retrieval.
• If one-off execution is unavoidable, specify an exact reviewed version and use the expected registry explicitly.
• Use npm integrity verification and audit the package and transitive dependency tree.
• Run the conversion in a minimally privileged, network-restricted environment with access limited to required input and output files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx glb-to-navmesh without pinning a package version or source, which allows the latest published package to be fetched and executed at runtime. If the package is compromised, typo-squatted, or updated maliciously, this becomes a supply-chain execution vector on the user's machine.

Content

No source excerpt is available for this finding.