Bambu Lab

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:21 PM UTC
• Version: 0.1.0

Overview

The skill mostly matches its printer-control purpose, but it ships real-looking printer credentials and unsafe control scripts that can affect a physical 3D printer.

Review before installing. Replace the embedded printer IP, serial number, access code, and chat ID with your own securely stored values, and rotate the exposed access code if it was ever real. Only run commands against the intended printer on a trusted LAN, understand that pause/resume/stop/light/fan commands affect hardware immediately, and avoid background or cron monitoring until credential handling, TLS verification, input validation, and temporary-file handling are fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/bambu.sh:18
• Finding: Hardcoded Printer Credentials Expose MQTT Control Access<![CDATA[ ## Vulnerability Details **File Location**: `scripts/bambu.sh:18-22`; duplicated in `scripts/bambu.py:20-24`, `scripts/bambu_monitor.py:20-24`, `SKILL.md:13-17`, `README.md:31-35`, and `references/mqtt.md:7-8` **Vulnerability Type**: Hardcoded credentials **Risk Level**: High ### Vulnerable Code ```bash # Konfiguration HOST="${BAMBU_HOST:-192.168.30.103}" PORT="${BAMBU_PORT:-8883}" SERIAL="${BAMBU_SERIAL:-03919A3A2200009}" ACCESS_CODE="${BAMBU_ACCESS_CODE:-33576961}" MODEL="${BAMBU_MODEL:-A1}" ``` The Python implementations contain equivalent hardcoded values: ```python HOST = "192.168.30.103" PORT = 8883 SERIAL = "03919A3A2200009" ACCESS_CODE = "33576961" MODEL = "A1" ``` ### Technical Analysis The project commits an apparently operational printer serial number, LAN address, and access code to source control and documentation. The serial number is used as the MQTT username, while the access code is used as the password. Although the shell implementation permits environment-variable overrides, the exposed values remain active defaults. The Python implementations do not provide environment-variable overrides and always use the committed credentials. Printer control messages are published to `device/<serial>/request`. Consequently, an individual who obtains the project and can reach the printer network has all information required to attempt MQTT authentication and issue printer commands. ### Attack Path 1. An attacker obtains a copy of the repository or a distributed Skill package. 2. The attacker extracts the printer IP address, serial number, and access code. 3. The attacker gains connectivity to the same LAN, VPN, or another network route exposing port 8883. 4. The attacker authenticates to the printer's MQTT service using the serial number and access code. 5. The attacker publishes supported commands to `device/03919A3A2200009/request`. 6. The attacker reads operational reports or issues actions such as pause, resume, stop, light control, ...[truncated 599 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Immediately rotate the exposed printer LAN access code. 2. Remove all real addresses, serial numbers, chat identifiers, and access codes from source code and documentation. 3. Require credentials through environment variables or a permission-restricted configuration file: ```bash : "${BAMBU_HOST:?BAMBU_HOST must be set}" : "${BAMBU_SERIAL:?BAMBU_SERIAL must be set}" : "${BAMBU_ACCESS_CODE:?BAMBU_ACCESS_CODE must be set}" ``` 4. Apply equivalent mandatory configuration handling to both Python scripts: ```python HOST = os.environ["BAMBU_HOST"] SERIAL = os.environ["BAMBU_SERIAL"] ACCESS_CODE = os.environ["BAMBU_ACCESS_CODE"] ``` 5. Replace documentation values with unmistakable placeholders such as `PRINTER_IP`, `PRINTER_SERIAL`, and `PRINTER_ACCESS_CODE`. 6. Store local secrets in a file excluded from version control and restrict it to the service account, such as mode `0600`. 7. Review repository history and distributed artifacts for prior copies of the credentials. 8. Restrict MQTT port 8883 at the network layer to specifically authorized management hosts. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/bambu.py:38
• Finding: MQTT Server Certificate Verification Is Disabled<![CDATA[ ## Vulnerability Details **File Location**: `scripts/bambu.py:38-39`; also present at `scripts/bambu_monitor.py:37-38` **Vulnerability Type**: Improper TLS certificate validation **Risk Level**: High ### Vulnerable Code ```python self.client = mqtt.Client() self.client.username_pw_set(SERIAL, ACCESS_CODE) self.client.tls_set(cert_reqs=ssl.CERT_NONE) self.client.tls_insecure_set(True) self.client.on_connect = self.on_connect self.client.on_message = self.on_message ``` The monitor repeats the same configuration: ```python self.client = mqtt.Client() self.client.username_pw_set(SERIAL, ACCESS_CODE) self.client.tls_set(cert_reqs=ssl.CERT_NONE) self.client.tls_insecure_set(True) self.client.on_connect = self.on_connect self.client.on_message = self.on_message ``` ### Technical Analysis `ssl.CERT_NONE` disables certificate validation, and `tls_insecure_set(True)` explicitly permits insecure TLS operation. The MQTT connection may be encrypted, but the client does not authenticate the server's identity. An attacker capable of redirecting local traffic can therefore present an arbitrary certificate and impersonate the printer. The client will accept the connection without verifying that it reached the intended device. Because MQTT authentication credentials and printer commands are transmitted through this connection, server impersonation can expose credentials, operational data, and control messages. False printer reports can also be supplied to the monitoring logic. ### Attack Path 1. The attacker obtains a position on the printer's local network or another relevant routing segment. 2. The attacker redirects printer traffic through ARP spoofing, route manipulation, address impersonation, or equivalent local-network techniques. 3. The attacker presents an attacker-controlled TLS endpoint on port 8883 using any certificate. 4. The Python client accepts the certificate because validation and identity checking are disabled. 5. The client sends the MQTT ...[truncated 898 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enable certificate verification and disable insecure mode: ```python self.client.tls_set( ca_certs="/path/to/trusted-printer-ca.pem", cert_reqs=ssl.CERT_REQUIRED, tls_version=ssl.PROTOCOL_TLS_CLIENT, ) self.client.tls_insecure_set(False) ``` 2. Trust only a narrowly scoped CA or certificate associated with the printer. 3. If conventional hostname validation is unsuitable for a local device addressed by IP, implement documented certificate or public-key fingerprint pinning rather than disabling all verification. 4. Fail closed when validation fails; do not silently retry with insecure TLS. 5. Apply identical protection to `bambu.py`, `bambu_monitor.py`, and the Mosquitto command-line implementation. 6. Rotate the exposed access code after deploying certificate validation because previous interception cannot be ruled out. 7. Segment the printer network and restrict MQTT connectivity to authorized clients. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/bambu.sh:257
• Finding: Unvalidated Fan-Speed Argument Reaches Bash Arithmetic Evaluation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/bambu.sh:257-276` **Vulnerability Type**: Shell arithmetic injection **Risk Level**: High ### Vulnerable Code ```bash cmd_fans() { check_mqtt local speed="${1:-}" if [ -z "$speed" ]; then echo "Fehler: Geschwindigkeit (0-15) angeben" echo "Verwendung: fans <0-15>" exit 1 fi # Konvertiere 0-15 zu 0-255 local pwm=$((speed * 17)) [ $pwm -gt 255 ] && pwm=255 echo "🌪️ Setze Lüfter auf $speed (PWM: $pwm)..." send_mqtt "{\"print\": {\"command\": \"gcode_line\", \"param\": \"M106 S$pwm\"}}" echo "✅ Fertig" } ``` ### Technical Analysis The code documents `speed` as an integer from 0 through 15 but only checks whether the argument is empty. It then inserts the untrusted value into Bash arithmetic evaluation. Bash arithmetic expressions are not simple decimal parsers. They support identifiers and compound expressions, and their evaluation semantics can cause attacker-controlled input to be interpreted rather than treated as inert numeric data. Passing untrusted text into `$((...))` without strict validation creates a command-injection surface and also permits malformed, negative, or otherwise unintended values. The upper-bound clamp does not provide input validation. It occurs only after arithmetic evaluation and does not enforce the documented lower bound or numeric syntax. ### Attack Path 1. An attacker gains influence over arguments supplied to `bambu.sh`, such as through an agent-generated command, wrapper script, automation input, or another untrusted caller. 2. The attacker invokes the `fans` command with a crafted arithmetic expression instead of an integer. 3. `cmd_fans` accepts the argument because it only rejects an empty string. 4. Bash evaluates the attacker-controlled value in `local pwm=$((speed * 17))`. 5. Crafted arithmetic syntax may trigger unintended shell evaluation or alter expression semantics. 6. Any resul ...[truncated 770 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Strictly validate the argument before any arithmetic operation: ```bash cmd_fans() { check_mqtt local speed="${1:-}" if [[ ! "$speed" =~ ^([0-9]|1[0-5])$ ]]; then echo "Error: speed must be an integer from 0 to 15" >&2 exit 1 fi local pwm=$((10#$speed * 17)) printf 'Setting fan to %s (PWM: %s)...\n' "$speed" "$pwm" send_mqtt "$(printf '{"print":{"command":"gcode_line","param":"M106 S%d"}}' "$pwm")" } ``` Additional hardening should include: 1. Reject signs, whitespace, arithmetic operators, variable names, substitutions, and values outside the expected range. 2. Use `10#` after validation to force base-10 interpretation. 3. Quote all shell test operands. 4. Run ShellCheck and add tests containing malformed and adversarial arguments. 5. Avoid constructing JSON manually where possible; use a JSON encoder. 6. Run the Skill under a dedicated, unprivileged operating-system account. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/bambu_monitor.py:91
• Finding: Predictable Temporary Notification File Permits Symlink Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `scripts/bambu_monitor.py:91-105` **Vulnerability Type**: Insecure temporary file handling **Risk Level**: Medium ### Vulnerable Code ```python # Versuche OpenClaw's message tool zu nutzen try: # Prüfe ob wir im OpenClaw Kontext sind if os.path.exists("/home/node/.openclaw"): # Schreibe Nachricht in eine Datei die OpenClaw lesen kann msg_file = "/tmp/bambu_notification.txt" with open(msg_file, 'w') as f: f.write(message) print(f"NOTIFICATION: {message}") return True except: pass ``` ### Technical Analysis The monitor writes notifications to a fixed, globally predictable path under `/tmp`. Standard `open(..., 'w')` behavior follows symbolic links and truncates an existing destination. On a multi-user system, another local user can create `/tmp/bambu_notification.txt` as a symbolic link to a file writable by the monitor account. When a notification is generated, the monitor follows the link and overwrites the target with attacker-predictable printer notification content. The broad exception handler suppresses evidence of failures, reducing visibility into attempted or successful manipulation. ### Attack Path 1. A local attacker determines that the monitor uses `/tmp/bambu_notification.txt`. 2. The attacker removes or races the expected path and creates a symbolic link at that location. 3. The symbolic link targets a file writable by the monitor process but not necessarily writable by the attacker. 4. A printer state transition, error, or progress milestone triggers `send_telegram`. 5. The monitor opens the predictable path with truncation enabled. 6. The operating system follows the link, and the target file is overwritten with notification text. ### Impact Assessment The direct impact is arbitrary-file truncation or limited-content overwrite within the monitor account's permissions. Potential consequences include: - Corrupting workspace ...[truncated 454 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not use a shared, fixed filename under `/tmp`. 2. Prefer a dedicated private runtime directory owned by the monitor account with mode `0700`. 3. If a temporary file is required, use Python's `tempfile` facilities: ```python import tempfile with tempfile.NamedTemporaryFile( mode="w", encoding="utf-8", prefix="bambu_notification_", delete=False, dir="/home/node/.openclaw/runtime", ) as notification_file: notification_file.write(message) ``` 4. If interoperability requires a stable path, create the file using secure no-follow and exclusive-creation flags, validate its owner and type, and atomically rename it into place. 5. Set restrictive permissions such as `0600`. 6. Avoid broad `except:` blocks. Catch specific exceptions and log them securely. 7. Ensure the notification consumer authenticates the file owner and does not trust arbitrary files placed in a shared directory. ]]>

T08 · Insecure Dependencies

Note

• Location: README.md:21
• Finding: Unpinned Python Dependency Produces an Uncontrolled Supply-Chain Input<![CDATA[ ## Vulnerability Details **File Location**: `README.md:21-27`; dependency requirement also surfaced at `scripts/bambu.py:12-17` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Low ### Vulnerable Code ```markdown **Abhängigkeit installieren:** ```bash # Für Python-Version (empfohlen) pip3 install paho-mqtt # ODER für Bash-Version apt-get install mosquitto-clients ``` ``` The runtime import path is: ```python try: import paho.mqtt.client as mqtt except ImportError: print("Fehler: paho-mqtt nicht installiert") print("Installiere mit: pip3 install paho-mqtt") sys.exit(1) ``` ### Technical Analysis The project instructs users to install `paho-mqtt` without a pinned version, lock file, or integrity hashes. Installation therefore resolves whichever release the configured package index considers current at installation time. This creates non-reproducible installations and prevents the audited project from defining the exact dependency code that will execute. A future compromised, malicious, or unexpectedly incompatible release could execute during installation or when imported by the printer-control scripts. No evidence shows that `paho-mqtt` itself is malicious. The finding concerns uncontrolled dependency resolution rather than a confirmed malicious package. ### Attack Path 1. A user follows the documented installation command. 2. `pip` contacts its configured package index and resolves the latest acceptable `paho-mqtt` distribution. 3. The project performs no version or hash verification. 4. If the selected release or package-index path has been compromised, attacker-controlled package content is installed. 5. The dependency executes when imported by `bambu.py` or `bambu_monitor.py`. 6. The malicious dependency gains the privileges and environment access of the user running those scripts. ### Impact Assessment A compromised dependency could execute arbitrary Python code as the installing or runtime user. ...[truncated 433 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Define a reviewed dependency version in a requirements file: ```text paho-mqtt==<reviewed-version> ``` 2. Generate and enforce cryptographic hashes: ```text paho-mqtt==<reviewed-version> \ --hash=sha256:<verified-distribution-hash> ``` 3. Install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Commit a lock file and update it through an explicit review process. 5. Use a dedicated virtual environment rather than the system Python environment. 6. Configure trusted package indexes explicitly and avoid unreviewed mirrors. 7. Add automated dependency vulnerability scanning and controlled update checks. 8. Pin or otherwise reproducibly manage the Mosquitto client dependency where the deployment environment supports package locking. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented behavior does not fully match the actual operational scope: it exposes hardcoded host and credentials and mentions extra device-control functions beyond the high-level description. This is dangerous because reviewers and users may authorize the skill for routine monitoring while it also enables undisclosed control actions and embeds sensitive access material for a physical device.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior does not fully match the actual operational scope: it exposes hardcoded host and credentials and mentions extra device-control functions beyond the high-level description. This is dangerous because reviewers and users may authorize the skill for routine monitoring while it also enables undisclosed control actions and embeds sensitive access material for a physical device.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script hardcodes the printer host, serial number, and access code directly in source, exposing live device credentials to anyone who can read the file or repository. An attacker with these values and network reachability to the printer could connect over MQTT and issue control commands such as pause, resume, stop, or other supported operations.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The README publishes a concrete printer serial number and MQTT access code in plaintext, which are effectively credentials for controlling a local Bambu Lab printer in LAN mode. Anyone with network access to the same environment could use these values to connect to the printer, monitor jobs, or issue control commands such as pause or stop; because this skill is explicitly for device control, exposed credentials are especially sensitive rather than merely illustrative.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README exposes a plaintext device identifier and access code without any warning that they are sensitive secrets, increasing the likelihood that users will copy the insecure pattern into their own deployments. In the context of an MQTT-based printer control skill, these values enable authenticated access to operational telemetry and control functions, so disclosure can lead to unauthorized monitoring or disruption of physical device operation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 77% confidence
• Finding: The skill advertises executable behavior involving network access, file operations, and environment usage, but the manifest does not declare any tool scope or permissions boundaries. In an agent setting, missing explicit scoping weakens reviewability and can allow broader-than-expected execution against local files, secrets, or networked devices.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The documentation contains a specific printer serial number and access code, which are effectively credentials for MQTT control of the device on the local network. Anyone with access to this skill content may be able to connect to the printer, monitor jobs, or issue control commands such as pause/stop, creating both confidentiality and physical-operation risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill documents commands that directly alter printer state, including stop, pause, light, and fan control, but provides no warning, confirmation guidance, or safety constraints. In a physical-device context, undocumented control side effects can interrupt active prints, waste material, and potentially create equipment or thermal-management issues if misused.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This markdown file includes commands to stop an active print and to start printing a file from the SD card, both of which can affect hardware operation and user jobs. The document does not provide any caution or user warning about interruption, unintended device action, or the need to verify the target printer/job before sending these commands.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The code not only embeds printer credentials but also silently configures and uses them without any warning, consent flow, or secure handling guidance. This increases the chance that users will unknowingly distribute valid credentials and operate a sensitive device integration with poor secret hygiene, enabling unauthorized printer access if the script is shared or exposed.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes this skill as being for print monitoring, status queries, control via pause/stop, and notifications. The `cmd_light` command adds a separate hardware-control capability to toggle the chamber light, which is not mentioned in the manifest and is not an obvious implementation detail of the stated monitoring/pause-stop scope.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script hardcodes a default printer access code and uses it automatically for authenticated MQTT control. Embedding live credentials in code is dangerous because anyone who can read the script or inherit its defaults can issue control commands to the printer, and the skill context makes this especially relevant because the credential directly authorizes pause, stop, resume, light, and G-code actions on a physical device.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This code issues an operational control command to the 3D printer by publishing a pause request over MQTT, but unlike the stop command it does not ask the user to confirm before acting. Pausing an active print can affect the user's job and hardware process, so some explicit confirmation or warning would improve safety disclosure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This function immediately sends a resume command to the printer over MQTT and only prints status messages after initiating the action. Because it changes the physical device state and may restart motion or heating-related workflow, the user should receive a clearer pre-action warning or confirmation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The function constructs and sends a G-code-based control command that changes printer fan behavior, but there is no confirmation step and no warning in the help text about immediate hardware-side effects. Modifying cooling during a print can affect print quality or operation, so the user should be clearly informed before execution.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The module docstring says this is printer monitoring with Telegram notifications, and the send_telegram docstring also states it sends messages via Telegram. In reality, send_telegram never uses the configured Telegram token or makes a Telegram API request; it only writes the message to /tmp/bambu_notification.txt and prints it, which directly contradicts the documented intent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script contains hardcoded sensitive printer credentials, including the device serial and access code, and also consumes a Telegram bot token from the environment. Hardcoded secrets are dangerous because anyone with file access can recover them and use them to connect to or control the printer on the LAN; in this skill context, that directly affects a physical device rather than only application data.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The natural-language content and usage instructions are presented only in German, which can impose a language constraint without user opt-in. The policy requires either offering language choice or clearly documenting and justifying a locale-specific limitation.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The connection section instructs the reader to use the printer serial number and access code for MQTT authentication, but it does not warn that the access code is a credential that should be protected. For markdown files, omission of privacy or system-integrity warnings around sensitive authentication details is in scope.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: User-facing strings, help text, prompts, and documentation are consistently in German throughout the script. There is no indication that the tool is region-specific or that users can opt into another language, which creates a locale policy concern.

Missing User Warnings

Low

• Confidence: 73% confidence
• Finding: The script sends operational control commands that affect the printer's active job, but unlike the stop command it provides no confirmation step or warning before executing them. While status messages are printed, they do not warn the user about the immediate device-impacting action.

Natural-Language Policy Violations

Low

• Confidence: 98% confidence
• Finding: Comments, help output, prompts, and status messages are written in German throughout the file, which effectively forces a specific language for user interaction. The file does not provide an opt-in language selection or explain that the skill is intentionally limited to German-speaking users.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script writes notification content to a predictable path in /tmp and persists printer state to disk without any permission hardening. In multi-user or shared environments, predictable temporary files can expose printer/job metadata and may be susceptible to tampering or symlink attacks, while the state file may leak operational details if stored with default permissions.

Static analysis

No suspicious patterns detected.