Security audit

Fusion 360 Bridge

Security checks for vulnerabilities and agentic risk

Overview

This skill is for legitimate Fusion 360 automation, but it documents a network-reachable raw Python execution bridge without enough security boundaries.

Install only if you trust the referenced repository and can run the bridge in a tightly controlled environment. Prefer localhost-only binding, avoid exposing port 8765 to a LAN or public network, review the external add-in/plugin source at a pinned commit, and understand that /exec can run arbitrary Python that may modify Fusion documents and affect the host user environment.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:37
Finding: Network-Accessible Unrestricted Python Execution
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:14
Finding: Installation of Mutable, Unpinned Remote Code
Content: View full analysis
/openclaw-plugin ``` ``` From `SKILL.md:253-268`: ```markdown ## OpenClaw Plugin integration This repository also ships an OpenClaw plugin at `openclaw-plugin/` and it must be used with the same Fusion Bridge repo above. When installed, prefer these tool names instead of manually calling endpoints: - `fusion_bridge_ping` - `fusion_bridge_state` - `fusion_bridge_logs` - `fusion_bridge_exec` Install from the same source: ```bash cd openclaw plugins install --link ./openclaw-plugin ``` ``` ### Technical Analysis The instructions retrieve executable components from the current state of an external Git repository. They do not pin an immutable commit, require a specific signed release, or provide a checksum for either the repository archive or installed files. Consequently, the effective code executed by this skill can change after the skill package has been reviewed. A comp ...[truncated 2744 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs use of a bridge that supports raw Python execution over HTTP via /exec, but it does not present any prominent warning, restriction guidance, or approval boundary for code that can affect the host running Fusion 360. In practice, this normalizes arbitrary remote code execution against the CAD workstation and could lead to file modification, destructive CAD actions, data exfiltration, or broader host compromise if the bridge is reachable by an unintended party.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill states the bridge listens on 0.0.0.0:8765 by default and discusses remote reachability, firewall, and LAN binding as operational concerns, but it omits a clear warning that exposing this service beyond localhost can grant network-accessible arbitrary code execution through /exec. Given the bridge is explicitly controllable over HTTP and supports uncapped code payloads, encouraging network exposure without strong security caveats materially increases risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation exposes a raw Python execution endpoint (POST /exec) that enables arbitrary code execution inside the Fusion 360 context, and it does so without any warning about trust boundaries, authentication expectations, or the security consequences of invoking it over HTTP. In this skill context, that is especially dangerous because the skill is explicitly designed to inspect or control Fusion over local/LAN HTTP, making it likely that an agent or user could call a powerful RCE surface without understanding that it can modify designs, access documents, or execute arbitrary local actions available to the Fusion process.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs use of a raw Python /exec endpoint and says raw Python is allowed with no artificial code-length cap, but it does not provide an explicit safety warning about arbitrary code execution risks. In practice, this enables full remote control of the Fusion host and potentially the underlying user environment if the bridge is reachable, making misuse or accidental dangerous actions much more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill says to treat the bridge as open inside a trusted environment, but elsewhere notes it listens on 0.0.0.0:8765 by default and exposes /exec, which can allow arbitrary remote execution if network-reachable. Framing the service as trusted without a strong warning about exposure, authentication, and network isolation understates the security risk and may lead operators to deploy an unsafe remote-control interface.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The documented observed fields include German strings such as Unbenannt and (Nicht gespeichert) without clarifying that these values are locale-dependent or user-configurable. This can amount to a natural-language locale assumption in the documentation rather than presenting language-neutral behavior or noting localization.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.