Security audit

Bambu Lab

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its printer-control purpose, but it ships real-looking printer credentials and unsafe control scripts that can affect a physical 3D printer.

Review before installing. Replace the embedded printer IP, serial number, access code, and chat ID with your own securely stored values, and rotate the exposed access code if it was ever real. Only run commands against the intended printer on a trusted LAN, understand that pause/resume/stop/light/fan commands affect hardware immediately, and avoid background or cron monitoring until credential handling, TLS verification, input validation, and temporary-file handling are fixed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/bambu.sh:18
Finding: Hardcoded Printer Credentials Expose MQTT Control Access
Content: View full analysis
/request`. Consequently, an individual who obtains the project and can reach the printer network has all information required to attempt MQTT authentication and issue printer commands. ### Attack Path 1. An attacker obtains a copy of the repository or a distributed Skill package. 2. The attacker extracts the printer IP address, serial number, and access code. 3. The attacker gains connectivity to the same LAN, VPN, or another network route exposing port 8883. 4. The attacker authenticates to the printer's MQTT service using the serial number and access code. 5. The attacker publishes supported commands to `device/03919A3A2200009/request`. 6. The attacker reads operational reports or issues actions such as pause, resume, stop, light control, ...[truncated 599 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/bambu.py:38
Finding: MQTT Server Certificate Verification Is Disabled
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/bambu.sh:257
Finding: Unvalidated Fan-Speed Argument Reaches Bash Arithmetic Evaluation
Content: View full analysis
" exit 1 fi # Konvertiere 0-15 zu 0-255 local pwm=$((speed * 17)) [ $pwm -gt 255 ] && pwm=255 echo "🌪️ Setze Lüfter auf $speed (PWM: $pwm)..." send_mqtt "{\"print\": {\"command\": \"gcode_line\", \"param\": \"M106 S$pwm\"}}" echo "✅ Fertig" } ``` ### Technical Analysis The code documents `speed` as an integer from 0 through 15 but only checks whether the argument is empty. It then inserts the untrusted value into Bash arithmetic evaluation. Bash arithmetic expressions are not simple decimal parsers. They support identifiers and compound expressions, and their evaluation semantics can cause attacker-controlled input to be interpreted rather than treated as inert numeric data. Passing untrusted text into `$((...))` without strict validation creates a command-injection surface and also permits malformed, negative, or otherwise unintended values. The upper-bound clamp does not provide input validation. It occurs only after arithmetic evaluation and does not enforce the documented lower bound or numeric syntax. ### Attack Path 1. An attacker gains influence over arguments supplied to `bambu.sh`, such as through an agent-generated command, wrapper script, automation input, or another untrusted caller. 2. The attacker invokes the `fans` command with a crafted arithmetic expression instead of an integer. 3. `cmd_fans` accepts the argument because it only rejects an empty string. 4. Bash evaluates the attacker-controlled value in `local pwm=$((speed * 17))`. 5. Crafted arithmetic syntax may trigger unintended shell evaluation or alter expression semantics. 6. Any resul ...[truncated 770 chars]
Remediation: View remediation
&2 exit 1 fi local pwm=$((10#$speed * 17)) printf 'Setting fan to %s (PWM: %s)...\n' "$speed" "$pwm" send_mqtt "$(printf '{"print":{"command":"gcode_line","param":"M106 S%d"}}' "$pwm")" } ``` Additional hardening should include: 1. Reject signs, whitespace, arithmetic operators, variable names, substitutions, and values outside the expected range. 2. Use `10#` after validation to force base-10 interpretation. 3. Quote all shell test operands. 4. Run ShellCheck and add tests containing malformed and adversarial arguments. 5. Avoid constructing JSON manually where possible; use a JSON encoder. 6. Run the Skill under a dedicated, unprivileged operating-system account. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/bambu_monitor.py:91
Finding: Predictable Temporary Notification File Permits Symlink Overwrite
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: README.md:21
Finding: Unpinned Python Dependency Produces an Uncontrolled Supply-Chain Input
Content: View full analysis
Remediation: View remediation
``` 2. Generate and enforce cryptographic hashes: ```text paho-mqtt== \ --hash=sha256: ``` 3. Install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Commit a lock file and update it through an explicit review process. 5. Use a dedicated virtual environment rather than the system Python environment. 6. Configure trusted package indexes explicitly and avoid unreviewed mirrors. 7. Add automated dependency vulnerability scanning and controlled update checks. 8. Pin or otherwise reproducibly manage the Mosquitto client dependency where the deployment environment supports package locking. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented behavior does not fully match the actual operational scope: it exposes hardcoded host and credentials and mentions extra device-control functions beyond the high-level description. This is dangerous because reviewers and users may authorize the skill for routine monitoring while it also enables undisclosed control actions and embeds sensitive access material for a physical device.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior does not fully match the actual operational scope: it exposes hardcoded host and credentials and mentions extra device-control functions beyond the high-level description. This is dangerous because reviewers and users may authorize the skill for routine monitoring while it also enables undisclosed control actions and embeds sensitive access material for a physical device.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script hardcodes the printer host, serial number, and access code directly in source, exposing live device credentials to anyone who can read the file or repository. An attacker with these values and network reachability to the printer could connect over MQTT and issue control commands such as pause, resume, stop, or other supported operations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README publishes a concrete printer serial number and MQTT access code in plaintext, which are effectively credentials for controlling a local Bambu Lab printer in LAN mode. Anyone with network access to the same environment could use these values to connect to the printer, monitor jobs, or issue control commands such as pause or stop; because this skill is explicitly for device control, exposed credentials are especially sensitive rather than merely illustrative.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README exposes a plaintext device identifier and access code without any warning that they are sensitive secrets, increasing the likelihood that users will copy the insecure pattern into their own deployments. In the context of an MQTT-based printer control skill, these values enable authenticated access to operational telemetry and control functions, so disclosure can lead to unauthorized monitoring or disruption of physical device operation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 77% confidence
Finding: The skill advertises executable behavior involving network access, file operations, and environment usage, but the manifest does not declare any tool scope or permissions boundaries. In an agent setting, missing explicit scoping weakens reviewability and can allow broader-than-expected execution against local files, secrets, or networked devices.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation contains a specific printer serial number and access code, which are effectively credentials for MQTT control of the device on the local network. Anyone with access to this skill content may be able to connect to the printer, monitor jobs, or issue control commands such as pause/stop, creating both confidentiality and physical-operation risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill documents commands that directly alter printer state, including stop, pause, light, and fan control, but provides no warning, confirmation guidance, or safety constraints. In a physical-device context, undocumented control side effects can interrupt active prints, waste material, and potentially create equipment or thermal-management issues if misused.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file includes commands to stop an active print and to start printing a file from the SD card, both of which can affect hardware operation and user jobs. The document does not provide any caution or user warning about interruption, unintended device action, or the need to verify the target printer/job before sending these commands.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code not only embeds printer credentials but also silently configures and uses them without any warning, consent flow, or secure handling guidance. This increases the chance that users will unknowingly distribute valid credentials and operate a sensitive device integration with poor secret hygiene, enabling unauthorized printer access if the script is shared or exposed.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes this skill as being for print monitoring, status queries, control via pause/stop, and notifications. The cmd_light command adds a separate hardware-control capability to toggle the chamber light, which is not mentioned in the manifest and is not an obvious implementation detail of the stated monitoring/pause-stop scope.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script hardcodes a default printer access code and uses it automatically for authenticated MQTT control. Embedding live credentials in code is dangerous because anyone who can read the script or inherit its defaults can issue control commands to the printer, and the skill context makes this especially relevant because the credential directly authorizes pause, stop, resume, light, and G-code actions on a physical device.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code issues an operational control command to the 3D printer by publishing a pause request over MQTT, but unlike the stop command it does not ask the user to confirm before acting. Pausing an active print can affect the user's job and hardware process, so some explicit confirmation or warning would improve safety disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This function immediately sends a resume command to the printer over MQTT and only prints status messages after initiating the action. Because it changes the physical device state and may restart motion or heating-related workflow, the user should receive a clearer pre-action warning or confirmation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The function constructs and sends a G-code-based control command that changes printer fan behavior, but there is no confirmation step and no warning in the help text about immediate hardware-side effects. Modifying cooling during a print can affect print quality or operation, so the user should be clearly informed before execution.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module docstring says this is printer monitoring with Telegram notifications, and the send_telegram docstring also states it sends messages via Telegram. In reality, send_telegram never uses the configured Telegram token or makes a Telegram API request; it only writes the message to /tmp/bambu_notification.txt and prints it, which directly contradicts the documented intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script contains hardcoded sensitive printer credentials, including the device serial and access code, and also consumes a Telegram bot token from the environment. Hardcoded secrets are dangerous because anyone with file access can recover them and use them to connect to or control the printer on the LAN; in this skill context, that directly affects a physical device rather than only application data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The natural-language content and usage instructions are presented only in German, which can impose a language constraint without user opt-in. The policy requires either offering language choice or clearly documenting and justifying a locale-specific limitation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The connection section instructs the reader to use the printer serial number and access code for MQTT authentication, but it does not warn that the access code is a credential that should be protected. For markdown files, omission of privacy or system-integrity warnings around sensitive authentication details is in scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: User-facing strings, help text, prompts, and documentation are consistently in German throughout the script. There is no indication that the tool is region-specific or that users can opt into another language, which creates a locale policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 73% confidence
Finding: The script sends operational control commands that affect the printer's active job, but unlike the stop command it provides no confirmation step or warning before executing them. While status messages are printed, they do not warn the user about the immediate device-impacting action.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Comments, help output, prompts, and status messages are written in German throughout the file, which effectively forces a specific language for user interaction. The file does not provide an opt-in language selection or explain that the skill is intentionally limited to German-speaking users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script writes notification content to a predictable path in /tmp and persists printer state to disk without any permission hardening. In multi-user or shared environments, predictable temporary files can expose printer/job metadata and may be susceptible to tampering or symlink attacks, while the state file may leak operational details if stored with default permissions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.