ClawHub
Back to skill

Security audit

rhino3d-plugins

Security checks for vulnerabilities and agentic risk

Overview

This is a Rhino plugin-development reference skill with visible, purpose-aligned guidance and no hidden executable behavior.

Installers should treat this as a specialized Rhino development reference. Review generated project settings and yak commands before running them, regenerate all placeholder GUIDs, and be careful with publishing, API keys, startup-loaded plugins, and persistence code because those affect users' Rhino environments and saved files.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill's auto-invocation criteria are broad enough to trigger on many general Rhino geometry and file-related topics, not just plugin development. Overly broad routing can cause the agent to apply specialized guidance in contexts it was not intended for, increasing the chance of irrelevant, risky, or overly authoritative assistance being injected into unrelated workflows.

Static analysis

No suspicious patterns detected.