Security audit

Bambu Lab Local Control

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real local Bambu printer-control skill, but it exposes high-impact printer commands with weak safeguards.

Review before installing. Use this only with a trusted local network and a printer you intend the agent to control. Treat raw G-code, stop, speed, and temperature commands as potentially disruptive physical actions, and prefer adding confirmations, G-code restrictions, and certificate pinning before routine use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: bambu.py:31
Finding: MQTT TLS Certificate Verification Is Disabled
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:17
Finding: Third-Party MQTT Dependency Is Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Arbitrary G-code is sent to the printer with no warning, validation, or restriction, despite direct physical effects on heaters, motors, fans, and motion systems. Because this is a hardware-control skill, unrestricted command injection is more dangerous than in a text-only tool: a single command can overheat components, move axes unexpectedly, or damage an in-progress job.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation exposes commands that can directly alter printer state, including pausing, stopping, changing temperatures, changing speed, toggling hardware, and sending arbitrary G-code, without any warning about safety, material waste, interrupted jobs, or hardware risk. In a skill specifically designed for physical device control, omitting cautions and confirmation guidance increases the chance that users or downstream agents invoke disruptive or irreversible actions inappropriately.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The print_control path issues pause, resume, and especially stop commands immediately with no confirmation, dry-run, or warning. In an agentic or automated environment, this can cause unexpected interruption of prints, wasted material, and possible unsafe state transitions if commands are triggered accidentally or by prompt manipulation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill exposes a raw gcode subcommand that forwards arbitrary user-supplied G-code directly to the printer. In the context of a printer-control skill, this expands the capability from bounded device management to unrestricted hardware control, enabling dangerous movements, heating, motor commands, or safety bypasses if invoked by a user, another tool, or an LLM agent without sufficient validation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module description and subsequent user-facing strings are written in French, and the script does not provide any locale or language selection. This can violate language-choice policy when a skill forces a specific language without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.