Security audit

Snapmaker

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly purpose-aligned, but it needs review because some physical printer controls can run immediately even though the documentation says state-changing actions require confirmation.

Review this before installing if the printer is shared, actively printing, or on an untrusted network. Treat config.json as a secret, use a dedicated trusted LAN, and do not let an agent invoke pause, resume, stop, send, or start unless you are ready for the printer to act immediately.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/snapmaker.py:89
Finding: Authentication Token Transmitted in Plaintext HTTP Query Strings
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/snapmaker.py:341
Finding: Destructive Printer Controls Execute Without Documented Confirmation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/snapmaker.py:429
Finding: Network-Controlled Strings Are Written to Terminals and Logs Without Sanitization
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:208
Finding: Unpinned Third-Party Dependency Installation Is Not Reproducible
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
gets no reply (e.g. different subnet).

Basic Commands

bash
# Get current printer status python3 scripts/snapmaker.py status # Watch print progress (updates every 5 seconds) python3 scripts/snapmaker.py watch # Get status as JSON python3 scripts/snapmaker.py status --json

Job Control

bash
# Send a file (prepares but doesn't start) python3 scripts/snapmaker.py send ~/prints/model.gcode # Send and start immediately python3 scripts/snapmaker.py send ~/prints/model.gcode --start --yes # Pause current print python3 scripts/snapmaker.py pause --yes # Resume paused print python3 scripts/snapmaker.py resume --yes # Stop/cancel print (requires confirmation) python3 scripts/snapmaker.py stop

Safety Flags

--yes - Skip confirmation prompts (use with caution!)

--force - Override safety checks (NOT RECOMMENDED)

All commands that modify state require confirmation unless --yes is provided.

API Endpoints

The skill uses these Snapmaker HTTP API v1 en

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 90% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
md
### Safety Flags - `--yes` - Skip confirmation prompts (use with caution!) - `--force` - Override safety checks (NOT RECOMMENDED) All commands that modify state require confirmation unless `--yes` is provided.

Instruction Override

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
md
### Safety Flags - `--yes` - Skip confirmation prompts (use with caution!) - `--force` - Override safety checks (NOT RECOMMENDED) All commands that modify state require confirmation unless `--yes` is provided.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents capabilities that read/write local files, use environment-dependent configuration, and perform network operations against a printer, but it declares no explicit tool scope or permission boundary. In an agent environment, this increases the chance of unintended access or execution beyond what a reviewer expects, making misuse or over-privileged operation harder to contain.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
md
- **Status monitoring** - Real-time printer status (temperatures, progress, position) - **Job management** - Send, start, pause, resume, and stop print jobs - **Safety features** - Prevents interfering with active prints without confirmation - **Progress watching** - Live monitoring of print progress - **Notification support** - Detect print completion, filament issues, errors

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation instructs users to store an API token in config.json but does not clearly label it as a secret or warn against exposing it in version control, logs, screenshots, or shared workspaces. If leaked, the token could allow unauthorized control of the printer, including starting, pausing, or stopping jobs.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: The documented --yes flag allows state-changing actions to proceed without confirmation, enabling unattended pause/resume/send/start operations if invoked by an agent or script. In the context of a physical device, removing confirmation increases the chance of unsafe or unintended printer actions, especially when combined with network access and job control commands.
Content: Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
md
### Safety Flags - `--yes` - Skip confirmation prompts (use with caution!) - `--force` - Override safety checks (NOT RECOMMENDED) All commands that modify state require confirmation unless `--yes` is provided.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document enumerates authenticated endpoints that can control printer behavior, upload G-code, and start or stop jobs, but it does not warn that the token is security-sensitive or that misuse can cause unauthorized physical actions and material waste. In the context of a skill intended to control real hardware, omitting credential-handling and operational safety cautions increases the chance of unsafe or overly permissive integrations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The stop/cancel operation immediately aborts an active print job with no confirmation prompt, unlike the send+start path which does prompt. In a tool controlling physical equipment, accidental invocation can waste materials, interrupt long-running jobs, and potentially leave hardware or workpieces in an undesirable state.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill description says it controls and monitors Snapmaker printers via their HTTP API, but the code also performs active UDP broadcast discovery and arbitrary targeted probing. That expands the capability from single-device control into local-network reconnaissance, which is a meaningful security boundary change because it can scan for devices beyond a preconfigured printer.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: UDP broadcast discovery sends packets to 255.255.255.255 and listens for responses from any host implementing the protocol. For a skill advertised as HTTP-based printer control, this introduces unnecessary network enumeration capability that could be abused to map devices on the LAN or bypass expectations that the tool only talks to a configured printer.
Content: No source excerpt is available for this finding.

Dynamic Request Target

Medium

Category: Server-Side Request Forgery
Confidence: 60% confidence
Finding: Request target host is built from a dynamic or untrusted value. If the host is attacker-influenced, this enables SSRF to arbitrary internal or metadata endpoints.
Content: Scanner excerpt · scripts/snapmaker.py (reported line 490)May include surrounding context.
python
if probe_ip: print(f"No UDP reply. Trying HTTP probe on {probe_ip}:{port}...") try: r = requests.get( f"http://{probe_ip}:{port}/api/v1/status", params={'token': config.get('token', '')}, timeout=5,

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The top-level documentation frames the tool as providing safe control of a Snapmaker printer, which suggests bounded interaction with the intended device. Elsewhere, the script performs unauthenticated UDP broadcast discovery and targeted probes across the network, which contradicts that narrow 'safe control' characterization.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

Basic Commands

Job Control

Safety Flags

API Endpoints

Anti-Refusal Statement

Instruction Override

Undeclared Tool Scope

Autonomous Decision Making

Missing User Warnings

Autonomous Decision Making

Missing User Warnings

Missing User Warnings

Description-Behavior Mismatch

Context-Inappropriate Capability

Dynamic Request Target

Intent-Code Divergence

Static analysis