Security audit

bambu-a1-modeler

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Portuguese-language 3D-printing helper for Bambu A1 workflows, with a limited local STL audit script and no hidden persistence or credential behavior.

Install this if you want a Brazilian Portuguese Bambu A1 3D-printing workflow that may create CAD/STL project files and run local validation tools. Review generated geometry and any Bambu Studio slicing output before printing, especially for functional, structural, electrical, heat, food-contact, medical, or protective-use parts.

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This is a mismatch because the declared description presents a broader CAD/print-preparation skill for Bambu Lab A1 Combo with STL/3MF, AMS Lite, and validation, while the actual code only performs basic geometric auditing of STL meshes. There is no evidence of parametric modeling, printer-specific preparation, 3MF support, or AMS Lite integration. Although the code does provide a form of validation, its primary purpose is much narrower than the declared purpose.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: A instrução 'Responda em português do Brasil' força um idioma/localidade específica para todas as interações. Pelas regras, isso configura violação de política de linguagem/locale quando não há opção explícita para o usuário escolher ou consentir.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The entire skill file is written in Portuguese, and there is no indication that the user may choose another language or that the skill is intentionally restricted to a Portuguese-speaking audience. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Low

Confidence: 97% confidence
Finding: This code emits user-facing text in Portuguese, including error messages, without offering any language choice or documenting a locale-specific constraint. The policy explicitly flags forced language/locale behavior when users are not given an opt-in or alternative.

Natural-Language Policy Violations

Low

Confidence: 99% confidence
Finding: Across warnings and CLI output, the script consistently uses Portuguese strings for all user-visible messages. Because the file provides no language toggle, opt-in, or justification for being region-specific, this is a natural-language policy concern.

Static analysis

No suspicious patterns detected.