Security audit

OctoClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a real OctoPrint helper, but it controls physical printer hardware and sends data externally without enough safety limits or scoping.

Install only if you are comfortable giving the agent control over a real 3D printer and outbound Telegram notifications. Use HTTPS for OctoPrint, a least-privileged API key, restrict config.json permissions, avoid telegram-msg for sensitive content, confirm every print/temperature/cancel action manually, and limit uploads and snapshots to known safe directories and G-code/image files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/octoprint.py:35
Finding: OctoPrint API Credentials May Be Transmitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/octoprint.py:324
Finding: Snapshot Command Allows Arbitrary File Overwrite and Symbolic-Link Following
Content: View full analysis
2 else None get_snapshot(output) ``` ### Technical Analysis The snapshot output path is accepted without restricting its destination, checking whether it already exists, or preventing symbolic-link traversal. Opening the path with mode `wb` truncates an existing file before writing attacker-influenced network content into it. The impact is bounded by the operating-system privileges of the process. However, skills are often run by an agent with access to user configuration, workspace files, SSH configuration, or other sensitive writable files. A malicious or mistaken invocation can therefore destroy or replace any file writable by that account. The generated default filename also uses a predictable second-resolution name under the shared `/tmp` directory. A local attacker could pre-create that path as a symbolic link before the snapshot is written. ### Attack Path **Explicit-path attack:** 1. An attacker causes th ...[truncated 1106 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/octoprint.py:505
Finding: Unbounded Temperature Commands Can Request Unsafe Heater Targets
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/octoprint.py:348
Finding: Telegram Bot Token Can Be Disclosed Through Logged Request Errors
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description frames the skill as printer control and monitoring, but the documented commands also include Telegram messaging, photo transmission to an external service, direct temperature control, and file upload. This mismatch can mislead users and orchestration systems about the true action surface, causing privacy-impacting or safety-sensitive operations to be invoked without adequate scrutiny or consent.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.
md
Helper script: `scripts/octoprint.py` (relative to this skill directory).

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 93% confidence
Finding: The exposed CLI command for sending Telegram messages advertises an exfiltration-capable feature directly in the tool interface. A generic 'send message' command is not necessary for core printer control and materially increases abuse potential by providing a straightforward outbound channel.
Content: Scanner excerpt · scripts/octoprint.py (reported line 550)May include surrounding context.
python
print(" upload <file> - Upload gcode file", file=sys.stderr) print(" telegram-status - Send status to Telegram", file=sys.stderr) print(" telegram-snapshot - Send snapshot to Telegram", file=sys.stderr) print(" telegram-msg <msg> - Send message to Telegram", file=sys.stderr) sys.exit(1) command = sys.argv[1]

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares no explicit tool scope even though its documented behavior requires file access and network communication. Without clear permission boundaries, an agent may invoke this skill in broader contexts than intended, increasing the chance of unintended local file access or networked actions against OctoPrint or related services.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger condition is broad enough to activate on general printer-related questions, including benign informational requests, even though the skill supports real-world actions like print control and temperature setting. Overbroad activation increases the chance that an agent will select this skill unnecessarily and perform or suggest operational actions without sufficiently clear user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The print-control section exposes pause, resume, cancel, print start, and temperature-setting commands without any warning that these are destructive or safety-sensitive actions. In the context of a physical printer, accidental invocation can waste material, damage an in-progress print, or create hardware and fire-risk conditions if temperatures are changed improperly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The webcam snapshot and Telegram features can capture and transmit images and status data to external destinations, but the markdown provides no privacy warning or consent guidance. This is dangerous because users may not realize that workspace images, printer state, filenames, or progress data could be sent off-device, creating privacy and information-leak risks.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill adds Telegram outbound messaging and photo transfer capabilities that are not disclosed in the manifest description, expanding the data-flow and control surface beyond expected OctoPrint operations. Hidden or under-disclosed external communications are dangerous because they can be used to export printer status, webcam images, or user-supplied content to a third party without informed consent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Arbitrary Telegram message sending is not necessary for core 3D-printer control and allows user-provided content to be transmitted to an external service. Even if intended as convenience functionality, it creates an exfiltration primitive that can relay sensitive information outside the local printer environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Telegram message sending sends user-provided content to an external third-party service without clear disclosure in the skill context. This is dangerous because it can be used as a general-purpose outbound channel for sensitive data unrelated to printer management.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The hardcoded Telegram API endpoint indicates intentional communication with an external service outside OctoPrint. In a printer-control skill, undisclosed third-party communication increases risk because it expands data exposure beyond the local printer system.
Content: Scanner excerpt · scripts/octoprint.py (reported line 356)May include surrounding context.
python
print("Error: Telegram not configured. Add telegram_bot_token and telegram_chat_id to config.json", file=sys.stderr) sys.exit(1) url = f"https://api.telegram.org/bot{config['telegram_bot_token']}/sendMessage" try: response = requests.post(url, json={

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: This POST sends message content to Telegram, creating an external transmission path to a third party. Because the content is caller-controlled and not limited to printer telemetry, it can be used to exfiltrate arbitrary information from the skill context.
Content: Scanner excerpt · scripts/octoprint.py (reported line 359)May include surrounding context.
python
url = f"https://api.telegram.org/bot{config['telegram_bot_token']}/sendMessage" try: response = requests.post(url, json={ "chat_id": config["telegram_chat_id"], "text": message, "parse_mode": "Markdown"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Sending webcam snapshots to Telegram exports image data from the local environment to an external service without clear disclosure. In the context of a 3D-printer skill, webcam images may capture the workspace, people, or other sensitive surroundings, making this more dangerous than ordinary printer telemetry.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: This endpoint is used to upload photos to Telegram, enabling external transmission of local image files. In this skill, the likely source is webcam snapshots, which can reveal the user's physical environment and therefore carry higher privacy impact than plain status data.
Content: Scanner excerpt · scripts/octoprint.py (reported line 383)May include surrounding context.
python
print(f"Error: Image file not found: {image_path}", file=sys.stderr) sys.exit(1) url = f"https://api.telegram.org/bot{config['telegram_bot_token']}/sendPhoto" try: with open(image_path, 'rb') as f:

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code can upload local files to OctoPrint, but this capability is not disclosed in the manifest. While file upload is plausibly related to print management, undisclosed local-file transmission broadens the skill's authority and can cause unintended exposure of local data if misused.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The upload operation transmits local file contents over the network to OctoPrint without any explicit user-facing warning at the point of use. This is risky because users may not realize a local file is being sent to a service, and the function accepts arbitrary paths rather than only vetted print artifacts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.