ClawHub
Back to skill

Security audit

moonraker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Moonraker printer-control helper; its printer actions are real but disclosed and aligned with its purpose.

Install only for a Moonraker printer you control, set MOONRAKER_HOST carefully, and treat cancel and emergency stop as disruptive physical-device actions that should be run only after explicit user confirmation. Be aware that the files command exposes printer G-code filenames, sizes, and modified times.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The skill description says it controls and monitors the printer, naming status, temperatures, pause, resume, cancel, and emergency stop, but the documented behavior also includes listing G-code files. While file listing is related to printer management, undocumented behavior reduces transparency and can mislead reviewers or users about the full data access surface.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill exposes shell-based operational capability via a helper script and raw curl commands but does not declare any explicit tool scope such as allowed tools or permissions. This weakens governance and reviewability because an agent may be able to invoke shell/network actions against the printer without clear policy boundaries, increasing the chance of unintended or unsafe device control.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The quick-command section presents pause, resume, and cancel as simple actions without warning that they directly disrupt an in-progress print and may waste material, time, or leave hardware in an unexpected state. In an agent context, terse operational commands without safety framing make accidental invocation more likely, especially for destructive actions like cancel.

Description-Behavior Mismatch

Low
Confidence
92% confidence
Finding
The manifest description says the skill controls and monitors a Klipper printer via Moonraker for print status, temperatures, pause, resume, cancel, and emergency stop. The documented `files` command adds browsing/listing printer gcode files, which is an additional behavior not mentioned in that stated scope.

Description-Behavior Mismatch

Low
Confidence
94% confidence
Finding
The manifest enumerates monitoring status/temps and controlling active prints, but does not mention accessing stored printer files. Calling `/server/files/list` introduces a distinct file-browsing capability not covered by the current description.

Static analysis

No suspicious patterns detected.