ClawHub
Back to skill

Security audit

Tripo 3d

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it advertises: it sends 3D-generation requests to Tripo or a documented proxy, with no evidence of hidden execution or unrelated data access.

Install only if you are comfortable sending 3D prompts, image URLs, task IDs, and uploaded file URLs to Tripo or, for the free tier, to the operator proxy. Use your own TRIPO_API_KEY for more direct routing, and delete ~/.tripo-skill-id if you want to reset the local free-tier identifier.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README states that, when no Tripo API key is provided, requests are routed through an operator-controlled proxy and authenticated with a shared proxy secret, but it does not clearly warn users that their prompts and potentially uploaded images are transmitted to that third party. For a skill that handles user-provided images and creative assets, this creates a meaningful transparency and privacy risk because sensitive or proprietary content may be sent off-platform without informed user consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrases 'User wants to visualize something in 3D' and 'make something look like LEGO or blocky' are broad and may overlap with ordinary design or explanatory requests that do not actually intend to invoke a 3D-generation skill. The file does not provide exclusion conditions or negative examples to narrow when the skill should not activate.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · index.mjs (reported line 6)May include surrounding context.

js
import { join } from "path";
import { tmpdir } from "os";

const TRIPO_API_BASE = "https://api.tripo3d.ai/v2/openapi";
const PROXY_BASE = "https://skills.vast-internal.com/platform/tripo";

let ephemeralUserId = null;

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · instructions.md (reported line 127)May include surrounding context.

md
import { join } from "path";
import { tmpdir } from "os";

const TRIPO_API_BASE = "https://api.tripo3d.ai/v2/openapi";
const PROXY_BASE = "https://skills.vast-internal.com/platform/tripo";

let ephemeralUserId = null;

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill creates and persists a stable identifier in the user's home directory (.tripo-skill-id) even though 3D generation does not inherently require long-term local tracking. This enables cross-session correlation of user activity and is especially concerning because that identifier is later transmitted to a remote proxy service, creating unnecessary privacy and tracking risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code writes a persistent user identifier locally without any user-facing disclosure, consent flow, or indication that the identifier will survive across runs. Undisclosed persistent identifiers can be used to profile usage over time and violate user expectations around privacy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The code accesses TRIPO_PROXY_SECRET and includes it in the x-proxy-secret header for outbound requests. While using a secret is expected for proxy authentication, this file lacks any explicit warning or inline documentation noting that a credential is read and sent to a remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill sends user-supplied prompts, image URLs, file URLs, and a stable user_id to an external proxy service. Because these inputs may contain sensitive creative content, internal asset URLs, or identifying information, undisclosed transmission expands privacy exposure and can leak user data to a third party beyond what users may expect from a local skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. This skill is primarily written in English but includes Chinese text inline for model-version guidance, which can force a specific language experience on users who did not opt into it.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The table entry contains Chinese text in an otherwise English instruction file, and no rationale or language-selection mechanism is provided. This creates a locale inconsistency that may violate organizational language policy for user-facing skill content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The instructions explicitly direct use of a shared proxy secret and state that it is sent on every proxy request, but they do not emphasize that this value is sensitive infrastructure credential material that must not be exposed to end users, logs, or untrusted systems. In a skill context, documenting operational secrets in user-facing instructions increases the risk of credential leakage, proxy abuse, and unauthorized use of the service.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
index.mjs:12