ClawHub
Back to skill

Security audit

Manage Bambu Labs 3D Printers thru your Agent

Security checks across malware telemetry and agentic risk

Overview

This documentation-only skill helps operate BambuLab printers with disclosed safety confirmations and no hidden code or persistence.

Install bambu-cli only from a trusted source, protect access-code files, and review every command before execution. Be especially careful with raw G-code, --no-check, temperature changes, movement, calibration, reboot, file deletion, and print stop actions because they can affect the printer and the active print.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- Use `light on|off|status`.

### Gcode and calibration
- Use `gcode send <line...>` or `gcode send --stdin` (confirmation required; `--no-check` skips validation).
- Avoid combining `--access-code-stdin` with `gcode send --stdin`; use an access code file instead.
- Use `calibrate` with `--no-bed-level`, `--no-motor-noise`, `--no-vibration` when requested.
Confidence
91% confidence
Finding
--no-check

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- `files download <remote> --out <path|->` (use `--force` for stdout on TTY)
- `files delete <remote>` - confirmation required.
- `camera snapshot [--out <path|->]` - default `snapshot.jpg` (use `--force` for stdout on TTY).
- `gcode send <line...> | --stdin` - confirmation required; `--no-check` to skip validation.
- `ams status` - show AMS data.
- `calibrate [--no-bed-level] [--no-motor-noise] [--no-vibration]` - confirmation required.
- `home` - home axes.
Confidence
95% confidence
Finding
--no-check

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.