Security audit

RhinoClaw

Security checks for vulnerabilities and agentic risk

Overview

This Rhino automation skill is coherent and disclosed, but it gives an agent broad live-model mutation and raw scripting power without strong safeguards.

Install only if you intend to let an agent control a live Rhino session. Use an auth token, run preflight first, keep backups or saved copies of important models, prefer typed helpers, and require explicit human confirmation before clear, delete, save/export, boolean, solid-edit, native-command, or arbitrary-script operations.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documents substantial capabilities including environment-variable access, file reads/writes, network communication, and shell execution, but does not declare permissions or present a clear capability boundary. That creates a transparency and governance gap: users or orchestration layers may grant or invoke the skill without understanding that it can reach outside Rhino and affect the host environment.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill claims to control Rhino over TCP, but also exposes arbitrary code execution inside Rhino (`execute_rhinoscript_python_code` / `execute_python3_code`) and a PowerShell-based WSL bridge that writes files and launches `powershell.exe`. Those behaviors materially expand the trust boundary from CAD automation to host-side command execution and remote scripting, increasing the risk of document compromise, lateral actions on the Rhino host, and abuse of the bridge path.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill is explicitly designed to create, modify, delete, save, export, and otherwise alter Rhino documents, but the top-level documentation does not prominently warn that operations may irreversibly change user data. In a CAD context this is dangerous because an agent can make broad destructive changes quickly, especially through batch operations and file tools.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation normalizes inline Python and native-command execution without a strong user-facing warning that these paths can perform broad, hard-to-audit changes beyond typed helpers. In context, arbitrary Rhino/Python execution significantly raises risk because it can bypass higher-level validation and invoke powerful APIs or commands on the remote Rhino host.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The boolean helpers default to `delete_input=True`, and the CLI mirrors that behavior unless the user explicitly passes `--keep`. In a geometry-control skill that can modify live Rhino models over TCP, this creates a real safety issue: a caller can unintentionally destroy source objects during union/difference/intersection operations with no confirmation, increasing the risk of irreversible data loss or corruption of a working model.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documented delete_object command enables irreversible modification of the active Rhino document, but the reference provides no warning, confirmation guidance, or mention of scoping safeguards. In an agent-operated skill, this omission increases the chance that an LLM or user invokes deletion on the wrong object or in the wrong document, causing data loss.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The delete_layer command is destructive because layer removal can affect project organization and may also remove or orphan associated contents depending on plugin behavior. Without any warning or description of side effects, an automated agent could damage the user's model structure at scale more easily than a normal interactive user.

Missing User Warnings

High

Confidence: 98% confidence
Finding: This command explicitly supports execution of arbitrary RhinoScript Python code inline, from files, or from stdin, which gives broad code execution capability inside the Rhino host context. In an agent skill exposed over TCP, this is especially dangerous because untrusted prompts, model mistakes, or chained tool use could lead to arbitrary local actions, document destruction, data exfiltration, or abuse of the Rhino environment.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The `clear` subcommand performs a bulk-destructive action that deletes every object in the active Rhino document with no confirmation prompt, dry-run mode, scope restriction, or explicit runtime warning. In a tool that controls a live 3D modeling session over TCP, accidental invocation, script misuse, or chaining by a higher-level agent can immediately destroy user work and cause data loss.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This tool directly forwards arbitrary Python/RhinoScript code to a Rhino instance for execution with no validation, policy restriction, sandboxing, or confirmation step. In the context of an agent skill, untrusted prompts or downstream tool inputs could cause execution of attacker-controlled code inside Rhino's Python environment, which may enable file access, data destruction, network access, or abuse of the Rhino host depending on the environment.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The solid-edit helpers default to destructive behavior by setting delete_input=True, so invoking fillet/chamfer without an explicit preservation flag will remove the original geometry. In a CAD automation skill, that can cause unintended data loss or irreversible model corruption, especially when used by higher-level agents or batch workflows that do not surface this default clearly to users.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The CLI wiring for split and trim makes cutter deletion easy to trigger without an explicit execution-time warning, and the underlying operations are inherently destructive to modeling state. In the Rhino/RhinoClaw context, where commands operate on live 3D documents over TCP and may be chained atomically, accidental deletion of source or cutter geometry can propagate quickly and damage project files.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: grasshopper.py:772

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: rhino_client.py:90