Security checks across malware telemetry and agentic risk
This skill broadly does what it claims, but it controls a real 3D printer and exposes external Telegram sending without enough built-in scoping or confirmation.
Install only if you trust the agent to control your OctoPrint instance. Keep the OctoPrint API key and Telegram credentials private, leave Telegram fields unset unless you intentionally want printer data sent to that chat, and require explicit human confirmation before starting/canceling prints, uploading files, changing temperatures, or sending snapshots/messages.
url = f"https://api.telegram.org/bot{config['telegram_bot_token']}/sendMessage"
try:
response = requests.post(url, json={
"chat_id": config["telegram_chat_id"],
"text": message,
"parse_mode": "Markdown"print("Error: Telegram not configured. Add telegram_bot_token and telegram_chat_id to config.json", file=sys.stderr)
sys.exit(1)
url = f"https://api.telegram.org/bot{config['telegram_bot_token']}/sendMessage"
try:
response = requests.post(url, json={print(f"Error: Image file not found: {image_path}", file=sys.stderr)
sys.exit(1)
url = f"https://api.telegram.org/bot{config['telegram_bot_token']}/sendPhoto"
try:
with open(image_path, 'rb') as f:print(" upload <file> - Upload gcode file", file=sys.stderr)
print(" telegram-status - Send status to Telegram", file=sys.stderr)
print(" telegram-snapshot - Send snapshot to Telegram", file=sys.stderr)
print(" telegram-msg <msg> - Send message to Telegram", file=sys.stderr)
sys.exit(1)
command = sys.argv[1]66/66 vendors flagged this skill as clean.