RhinoClaw

• Outcome: Review
• Latest audit: Jul 17, 2026 · 10:54 PM UTC
• Version: 0.7.2

Overview

This Rhino automation skill is coherent, but it gives an agent powerful live-control abilities over Rhino documents, including arbitrary Python execution and destructive edits without strong guardrails.

Install only if you intentionally want an agent to control a live Rhino session. Use it with an auth token, point it only at a Rhino host you control, keep backups of active models, and require explicit user approval before running arbitrary Python, native Rhino commands, clear/delete operations, file save/open/export actions, or large Grasshopper batches.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill clearly enables network access, environment-variable use, and file/path access, but the metadata shown in the file does not declare any permissions or capability boundaries. That creates a governance and review gap: an agent may invoke a skill with broader access than users expect, including connecting to remote Rhino hosts and handling authentication tokens from environment variables.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly exposes a command for executing arbitrary RhinoScript Python code inline, from a file, or from stdin. That goes beyond constrained CAD operations and effectively grants a general-purpose code execution surface inside the Rhino host context, which can be abused to run unsafe automation, modify documents unpredictably, or interact with local resources available to Rhino/Python.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill advertises the ability to create, modify, delete, import/export, and batch operations against a live Rhino instance, including rollback/abort behavior and native-command execution, but it does not prominently warn that these actions can alter project files, geometry, layers, or external assets. In an agent context, insufficient warning increases the risk of unintended destructive changes or misuse on the wrong host/session.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The CLI exposes destructive geometry operations where `join` and `explode` delete the original input objects by default unless the user remembers to pass `--keep`. In a CAD automation skill, this can cause unintended irreversible model changes, data loss, or corruption of a design workflow, especially when invoked by higher-level agents or scripts that assume non-destructive defaults.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code launches GrasshopperPlayer and then automatically drives Rhino’s command prompt by sending keystrokes and applying user-supplied parameters, which can create and modify geometry in the active Rhino document without any execution-time confirmation or safety gate. In this skill’s context, the behavior is expected functionality, but it still creates a real safety boundary issue: a caller can trigger destructive or unintended document changes on the Rhino host with no last-mile consent, preview, or restricted execution mode.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The delete_object command is destructive and is documented as a normal operation without warning, confirmation, or guidance on safe use. In an agentic context, that increases the chance of accidental or unauthorized deletion of model data, especially when object IDs may be selected programmatically.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: Layer deletion can have broad document impact because layers may organize many objects, materials, visibility states, or workflow assumptions. Documenting delete_layer without any warning or scope explanation makes accidental large-scale changes more likely in automated use.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Arbitrary script execution is documented with direct examples but no safety warning, despite enabling unrestricted RhinoScript Python execution. In this skill context, that is especially dangerous because the skill is intended for remote control over TCP, so an agent could be induced to send powerful scripts to the Rhino host without adequate guardrails.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The `clear` subcommand invokes `clear_all()`, which deletes every object in the active Rhino document without any confirmation prompt, dry-run mode, scope restriction, or undo/safety guard in this wrapper. In a skill that remotely controls a live Rhino instance over TCP, accidental or unintended invocation can cause immediate destructive data loss to the user's active scene, especially if the document has unsaved work.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: grasshopper.py:772

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: rhino_client.py:90