Snapmaker

• Analyzed: May 12, 2026, 3:22 AM
• Findings: 1
• Version: 1.2.2
• Hash: 6a34087c13ee1897e1c9ad5afc1e4d7389b3eddebbfc1c946725f448b532b50d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to control Snapmaker 2.0 3D printers via their local HTTP API. It includes several explicit security measures, such as path sandboxing for file uploads (restricting to workspace or /tmp) in `scripts/snapmaker.py` and preventing arbitrary file writes for logs in `scripts/monitor.py`. The `SKILL.md` instructions are clear and do not contain any prompt injection attempts. All network communication is directed to the specified local printer IP, and there is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation. The use of a token as a query parameter is noted as a requirement of the LAN-only Snapmaker API, which limits its exposure.