OctoClaw

• Risk level: Low
• Analyzed: Feb 17, 2026, 1:27 AM
• Findings: 0
• Version: 1.0.0

Overview

The skill's files and instructions are consistent with its stated purpose (controlling OctoPrint, snapshots, gcode analysis and optional Telegram alerts); nothing in the provided artifacts indicates covert exfiltration or unrelated access — but the shipped script was only partially shown and a few minor inconsistencies and hygiene issues deserve attention before use.

This skill appears to do what it says (control OctoPrint and related tasks). Before installing: 1) Inspect the full scripts/octoprint.py (we only saw a truncated excerpt) to confirm there are no hidden network endpoints or unexpected behaviors. 2) Ensure the Python runtime has the 'requests' package available or install it in a controlled environment. 3) Keep config.json (which stores your OctoPrint API key and any Telegram tokens) private and only place trusted credentials there. 4) Be cautious with 'analyze' or 'upload' commands — they read local files, so don't point them at sensitive system files. 5) If you will enable Telegram features, verify the destination chat/token are correct and intended. If you want higher assurance, run the script in an isolated environment (container or VM) and review the complete source file for any network calls beyond OctoPrint/Telegram endpoints.