ClawHub
Back to skill

Security audit

rhino3d-plugins

Security checks for vulnerabilities and agentic risk

Overview

This is a Rhino3D development reference skill with disclosed, purpose-aligned guidance, though users should pin dependencies before running install examples.

Install only if you are doing Rhino plugin or script development. Before running copied commands, pin NuGet and Python dependency versions, review generated project files before building, and treat yak login/push commands as publishing actions that should be run only from a trusted environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:97
Finding

Unpinned Rhino template package allows dependency drift and supply-chain compromise

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:551
Finding

Unpinned inline Python dependencies permit mutable code installation on first run

Content
View full analysis
Remediation
View remediation
# r: numpy==1.26.4 ``` 2. Remove wording that makes version pinning optional. Make pinning the default requirement for generated scripts. 3. Where Rhino supports PEP 723 metadata and hashes, use exact versions together with integrity hashes. 4. Restrict dependency resolution to approved package sources and avoid unreviewed custom indexes or `git+` dependencies. 5. Prefer prebuilt wheels from trusted publishers. Avoid source distributions where possible because their build backends may execute during installation. 6. Audit transitive dependencies and update pins through a controlled review process. 7. Test dependency installation in a sandboxed environment before running the script against sensitive models or within a privileged Rhino process. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
`assets/plugin-project-template.md` has the complete, annotated scaffolding: three `.csproj`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

md
`assets/plugin-project-template.md` has the complete, annotated scaffolding: three `.csproj`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 691)May include surrounding context.

md
`assets/plugin-project-template.md` has the complete, annotated scaffolding: three `.csproj`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 447)May include surrounding context.

md
is deliberately Windows-only. `assets/ui-patterns.md` has complete, adaptable implementations

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 695)May include surrounding context.

md
is deliberately Windows-only. `assets/ui-patterns.md` has complete, adaptable implementations

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 515)May include surrounding context.

md
painful. `scripts/persistence-and-userdata.md` has all four with working code.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 699)May include surrounding context.

md
painful. `scripts/persistence-and-userdata.md` has all four with working code.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · assets/plugin-project-template.md (reported line 315)May include surrounding context.

r .resx.** GenerateResourceUsePreserializedResources, the System.Resources.Extensions package, and the EmbeddedResource item are one unit — with any of the three missing, icon resources fail to build or the icon comes out blank. The manifest resource name that [PlugInDescription(DescriptionType.Icon, ...)] takes is derived from this item's path (see §8).

xml
  <PropertyGroup>
    <!-- Required on .NET 7+ to embed System.Drawing.Bitmap / Icon in a .resx. -->
    <GenerateResourceUsePreserializedResources>true</GenerateResourceUsePreserializedResources>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="System.Resources.Extensions" Version="8.0.0" ExcludeAssets="runtime" />
  </ItemGroup>

  <!-- If you also keep a Properties\Resources.resx with a generated designer
       file, your IDE writes the matching <Compile Update="...Designer.cs"> /
       <EmbeddedResource Update="...resx"> pair for you. -->
  <ItemGroup>
    <EmbeddedResource Include="Resources\

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · assets/ui-patterns.md (reported line 430)May include surrounding context.

md
public override object PageControl
      => m_control ?? (m_control = new MyOptionsPageControl());

    public override System.Drawing.Image PageImage => Properties.Resources.MyPageIcon;

    public override bool OnActivate(bool active) => m_control == null || m_control.OnActivate(active);
    public override bool OnApply() => m_control == null || m_control.OnApply();

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · assets/ui-patterns.md (reported line 842)May include surrounding context.

md
public override object PageControl
      => m_control ?? (m_control = new MyOptionsPageControl());

    public override System.Drawing.Image PageImage => Properties.Resources.MyPageIcon;

    public override bool OnActivate(bool active) => m_control == null || m_control.OnActivate(active);
    public override bool OnApply() => m_control == null || m_control.OnApply();

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs invocation not only for explicit Rhino plugin work but also for broad Rhino-adjacent topics such as general geometry, document objects, and file types. That can cause the agent to apply this highly specialized skill in contexts where it is not the best fit, increasing the chance of irrelevant guidance, unsafe assumptions, or over-permissioned behavior in downstream automation.

Content

No source excerpt is available for this finding.