ClawHub
Back to skill

Security audit

claw3d

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its 3D printing purpose, but it gives an agent broad printer and local-file authority with weak safety and scoping controls.

Review this skill before installing it on any shared or production OpenClaw instance. It should only run where users trust the configured claw3d package, printer endpoints, and external AI providers, and where physical printer actions require clear human confirmation. Avoid multi-user media directories unless attachment ownership is enforced, and prefer a pinned audited claw3d version with least-privilege access to API keys and printer controls.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
src/06-intent.md:76
Finding

Cross-Session Media Disclosure Through Unscoped Newest-File Selection

Content
View full analysis
/dev/null | head -5 ``` Pick the most recent video file (`.mp4`, `.mov`, `.webm`). Use that as the path. ``` ### Technical Analysis When the current message does not expose an attachment path, the Skill enumerates the shared OpenClaw inbound-media directory and selects a video based solely on modification time. It does not verify that the selected file belongs to the current message, user, conversation, or session. The selected file may subsequently be passed to commands such as: ```bash claw3d extract-frame --input --output frame_.jpg claw3d analyze --input frame_.jpg --description "" claw3d convert --image --output model_.glb ``` Analysis and conversion may use Gemini or FAL-backed services. Consequently, selecting the wrong file can result not only in local unauthorized access but also in transmission of another user's media to an external AI provider. Selecting files by recency is especially unsafe in concurrent or multi-user deployments because another upload can become the newest file between the original request and directory enumeration. ### Attack Path 1. A victim uploads a private video to an OpenClaw deployment. 2. The video is stored in `/home/node/.openclaw/media/inbound/`. 3. An attacker initiates a video-processing request for which the current attachment path is unavailable or suppressed. 4. The Skill runs: ```bash ls -t /home/node/.openclaw/media/inbound/ 2>/dev/null | head -5 ``` 5. The victim's video ...[truncated 1104 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
src/01-core.md:26
Finding

Shell Command Injection Through Unquoted User-Derived Arguments

Content
View full analysis
" --host --port --profile-from-3mf ``` Related image-processing template: ```bash ID=b10560d7 # from MediaPath claw3d convert --image --output model_${ID}.glb ``` Related instruction: ```markdown **MediaPath:** When the user attaches a file (image, GLB, 3MF), the message includes a **MediaPath** — the full filesystem path. **Always** pass that exact path to `--image`, `--edit-3d`, `--profile-from-3mf`, etc. Copy it character-for-character. ``` ### Technical Analysis The Skill directs the agent to invoke commands through `exec` while interpolating values derived from user messages or attachment metadata. Dynamic values include: - Printer names. - Hostnames and IP-address fields. - Ports. - Media paths. - Profile and printer identifiers. - AI prompts and descriptions in other templates. Several placeholders are not shell-quoted. Even values shown inside double quotes are not safe if the agent substitutes untrusted content containing command substitution syntax or other shell metacharacters. If `exec` invokes a shell, a malicious value can change command parsing. For example, a crafted host or path containing `;`, `&&`, `|`, `$()`, backticks, redirection operators, whitespace, or option prefixes can inject commands or unintended arguments. The instruction to copy a path character-for-character does not provide shell escaping. Attachment filenames can legitimately contain spaces and may contain shell-significant characters depending on the upload pipeline. ### Attack Path 1. An attacker supplies a crafted printer field or attachment filename containing ...[truncated 1526 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
src/00-frontmatter.md:13
Finding

Unpinned Installation of a Security-Sensitive Executable Dependency

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (41)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md
ould only see friendly, concise messages — never references to "Primary Gate", "SKILL.md", module names, decision rules, or your thought process. If you need to

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill includes instructions to upload G-code and start a print with no mandatory safety interlock, environment check, or explicit final confirmation immediately before initiating hardware. Because this controls a physical printer, unsafe or mistaken actions can cause equipment damage, wasted material, or safety incidents.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
70% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/build-skill.sh (reported line 43)May include surrounding context.

sh
fi

# Build requires JSON for OpenClaw metadata
# Collect env vars from selected modules
REQUIRES_ENV=()
for mod in "${MODULES_ARR[@]}"; do
  mod="${mod// /}"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
"label": "Install claw3d (via uv)"
        }
      ],
      "setupNote": "FAL_API_KEY: required for 3D generation (use input above or .env). GEMINI_API_KEY: optional but recommended — enables image intent analysis and video-to-3D (Gemini 2.5 Flash, free tier at aistudio.google.com/apikey). THINGIVERSE_ACCESS_TOKEN: add to .env for model search. VIDEO SUPPORT: OpenClaw defaults to a 5MB media limit per channel. To allow videos up to 50MB via Telegram, add to openclaw.json under channels.telegram: {\"mediaMaxMb\":50}"
    }
  }
---

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/00-frontmatter.md (reported line 21)May include surrounding context.

md
"label": "Install claw3d (via uv)"
        }
      ],
      "setupNote": "FAL_API_KEY: required for 3D generation (use input above or .env). GEMINI_API_KEY: optional but recommended — enables image intent analysis and video-to-3D (Gemini 2.5 Flash, free tier at aistudio.google.com/apikey). THINGIVERSE_ACCESS_TOKEN: add to .env for model search. VIDEO SUPPORT: OpenClaw defaults to a 5MB media limit per channel. To allow videos up to 50MB via Telegram, add to openclaw.json under channels.telegram: {\"mediaMaxMb\":50}"
    }
  }
---

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly directs the agent to proceed from model conversion and slicing to claw3d print --gcode ... without requiring an explicit user confirmation immediately before starting a physical print. Initiating real-world device actions can waste material, damage equipment, or create safety hazards if the model, printer selection, dimensions, or environment are incorrect; the surrounding instruction to 'execute immediately' increases the likelihood of unsafe automatic actuation.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 561)May include surrounding context.

md
**Always require an image or sketch.** Do not use text-only `--prompt` for new model creation — results are not accurate enough. If the user asks to "make a cup" without an image, ask them to send a sketch or photo, or offer to search Thingiverse instead.

**CRITICAL — User sent a GLB and wants to edit it:** Run `claw3d convert --edit-3d <GLB_MediaPath> --prompt "..." --output edited_<ID>.glb`. Never say you cannot edit 3D models.

## Acknowledge Before Converting

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · src/02-ai-forger.md (reported line 15)May include surrounding context.

md
**Always require an image or sketch.** Do not use text-only `--prompt` for new model creation — results are not accurate enough. If the user asks to "make a cup" without an image, ask them to send a sketch or photo, or offer to search Thingiverse instead.

**CRITICAL — User sent a GLB and wants to edit it:** Run `claw3d convert --edit-3d <GLB_MediaPath> --prompt "..." --output edited_<ID>.glb`. Never say you cannot edit 3D models.

## Acknowledge Before Converting

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 904)May include surrounding context.

md
<!-- MODULE: slicing -->

## Slicing — Profile Selection

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · src/04-slicing.md (reported line 1)May include surrounding context.

md
<!-- MODULE: slicing -->

## Slicing — Profile Selection

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1106)May include surrounding context.

md
<!-- MODULE: printing -->

## Printer Setup — Do This First

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · src/05-printing.md (reported line 1)May include surrounding context.

md
<!-- MODULE: printing -->

## Printer Setup — Do This First

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

md
<!-- MODULE: intent -->

## CRITICAL: Never Expose Internal Reasoning to the User

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · src/06-intent.md (reported line 1)May include surrounding context.

md
<!-- MODULE: intent -->

## CRITICAL: Never Expose Internal Reasoning to the User

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill directs the agent to modify /home/node/.openclaw/openclaw.json to raise Telegram upload limits, which changes host application configuration outside the core 3D-modeling task. That grants the skill authority to alter system behavior persistently and could be abused as a precedent for broader config tampering or unsafe operational changes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 25)May include surrounding context.

md
## How to contribute

1. Fork the repo and create a branch from `main`
2. Edit the relevant `src/*.md` file
3. Run `./scripts/build-skill.sh` to rebuild `SKILL.md`
4. Test by deploying the skill to a local OpenClaw instance

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: claw3d
description: "Unified 3D workflow: create models (AI), search (Thingiverse), slice, print. Modular—enable only what you need."
metadata:
  {
    "openclaw": {

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly instructs the agent to edit /home/node/.openclaw/openclaw.json to increase Telegram media limits and relies on an automatic channel restart. That is a local configuration change outside the core 3D workflow, and making it from a conversational skill can alter platform behavior without clear administrative consent or safety boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill tells the agent to patch a local configuration file and implies the Telegram channel will restart automatically, but it does not require a prominent user-facing warning about editing system configuration. That weak consent model is risky because it normalizes persistent environment changes from a regular task flow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The printer module exposes commands such as pause, resume, cancel, home, preheat, cooldown, camera, start, and emergency-stop, which go beyond passive file processing and enable direct physical device control. In a chat-driven skill, broad hardware control materially increases the risk of unsafe or unintended actions, especially if invoked automatically or with weak confirmation requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow exposes destructive and safety-critical printer operations such as emergency stop, start, cancel, home, and preheat as direct agent actions without any required confirmation, authorization, or safety interlocks. In an LLM-driven environment, ambiguous prompts, prompt injection from prior content, or simple misclassification could trigger physical actions on attached hardware, causing print loss, equipment wear, or hazardous motion/heat events.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · WORKFLOW.md (reported line 703)May include surrounding context.

Problem: When the user says "re-slice but stronger", the agent must remember the previous settings (max-dimension, strength, quality, infill, etc.). If the agent forgets or context is compacted, it either uses defaults or asks again.

Solution: Create model_<ID>.slice_config.json sidecar. Every claw3d slice call writes it. Next slice reads it as defaults.

json
{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest advertises printer control and printing capabilities but provides no explicit warning that these actions can cause irreversible real-world effects, such as starting a physical print job, moving hardware, or consuming materials. In an agent skill, lack of upfront disclosure increases the risk of a user invoking hardware-affecting functions without understanding the consequences, especially because printer-control actions bridge directly from software to physical devices.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The instructions require the agent to reply immediately using fixed English acknowledgement phrases. This imposes a language choice on all users without opt-in or an alternative locale path, which is a natural-language policy violation under the language/locale rule.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 317)May include surrounding context.

md
> 2. **Strength** — How strong? (10%, 25%, 50%, 75%, or 100%)
   > 3. **Detail** — How much print quality? (10%, 25%, 50%, 75%, or 100%)

   This is **mandatory** for AI-generated models — they have no real-world dimensions, so you MUST get the max print size from the user before slicing. Do NOT slice without asking. Do NOT use a default size.

**CRITICAL:** Run convert and preview via exec BEFORE sending. The files do not exist until you create them.

Static analysis

No suspicious patterns detected.