Security audit

Autodesk 3Ds Max - Agents Help with 3D work

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real desktop-app automation bridge, but it asks the agent to trust mutable external instructions and install an unpinned package that can execute setup code.

Review before installing. Only use this skill for a specific app and document you intend to automate, inspect the Flue package/source first, prefer a pinned version or isolated environment, and do not approve setup unless you understand what files and app integrations it will add.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:16
Finding: Unpinned Third-Party Package Installation Followed by Setup Execution
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:15
Finding: Operational Instructions Delegated to a Mutable External Skill File
Content: View full analysis
_adapter/APP.md` for the operational contract, then work from there. ``` ### Technical Analysis The Skill directs the agent to load operational instructions from files outside the audited project. The referenced `SKILL.md` and adapter-specific `APP.md` are not included in the artifact, and no version, hash, signature, ownership check, or trusted installation root is specified. Skill files are instructions rather than ordinary inert data. If an attacker can replace or alter either external document, the attacker can inject instructions that are processed after this reviewed Skill is loaded. Those instructions may attempt to change the agent's current goals, weaken safety constraints, cause unsafe tool calls, or direct execution of attacker-selected scripts. The hard-coded user-specific path also fails to establish that the file belongs to the expected package installation. This finding represents a trust-boundary weakness; the reviewed external files were not available, so no claim is made that they are currently malicious. ### Attack Path 1. An attacker or compromised installation process gains write access to the referenced local Flue Skill or adapter documentation. 2. The attacker adds instructions that request unsafe shell commands, unauthorized data access, or execution of attacker-controlled adapter code. 3. A user asks the agent to operate a supported desktop application. 4. Following `SKILL.md`, the agent reads the modified external `SKILL.md` and `APP.md`. 5. The external instructions are treated as the operational source of truth. 6. The agent may follow the injected directions using its available shell, filesystem, bridge, or desktop-applicatio ...[truncated 749 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill metadata and title present the capability as Autodesk-specific, but the body explicitly expands scope to many unrelated applications. This mismatch can cause an agent or user to invoke the skill in contexts far broader than expected, increasing the chance of unintended automation against other installed desktop applications with different risk profiles.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.