3daistudio integration

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:24 AM UTC
• Version: 1.0.4

Overview

This 3D-generation skill is mostly coherent, but it needs review because it can spend paid API credits and downloads provider-supplied URLs without validating where they point.

Install only if you are comfortable giving the skill your 3D AI Studio API key and letting agent-run generation commands spend account credits. Require explicit approval before each paid generation, use a limited-output directory, and review or harden the downloader so it only fetches HTTPS assets from trusted 3D AI Studio/CDN hosts with size and format limits.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: 3daistudio.py:96

Finding

Unvalidated Server-Provided Asset URL Enables Arbitrary Resource Retrieval

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tainted flow: 'req' from os.environ.get (line 43, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · 3daistudio.py (reported line 36)May include surrounding context.

python

def api_get(path):
    url = BASE_URL + path
    req = urllib.request.Request(url, headers=HEADERS)
    with urllib.request.urlopen(req, timeout=30) as r:
        return json.loads(r.read().decode())

Tainted flow: 'req' from os.environ.get (line 43, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · 3daistudio.py (reported line 44)May include surrounding context.

python

def api_get(path):
    url = BASE_URL + path
    req = urllib.request.Request(url, headers=HEADERS)
    with urllib.request.urlopen(req, timeout=30) as r:
        return json.loads(r.read().decode())

Tainted flow: 'req' from os.environ.get (line 43, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The code downloads a file from asset_url returned by the remote API without validating the scheme, host, or content size. If the upstream service is compromised or returns unexpected URLs, this could enable server-side request forgery-like outbound requests or downloading untrusted content to an arbitrary local path supplied by the user.

Content

Scanner excerpt · 3daistudio.py (reported line 104)May include surrounding context.

python

print(f"  Downloading from: {asset_url}")
    req = urllib.request.Request(asset_url)
    with urllib.request.urlopen(req, timeout=60) as r:
        with open(output_path, "wb") as f:
            f.write(r.read())
    print(f"  Saved to: {output_path}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The agent workflow section recommends directly running paid generation commands without repeating that each invocation consumes account credits. In agent contexts, this omission can lead to autonomous or repeated executions that incur unexpected financial charges, especially when users only read the workflow section and not earlier prerequisite sections.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guide instructs users to treat a .glb output as a ZIP archive and extract OBJ data from it, which conflicts with the stated output format and typical GLB semantics. If false, this can cause downstream automation to mishandle files, fail open on file-type assumptions, or encourage unsafe parsing logic based on incorrect documentation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill requires access to an API key via environment variables and makes outbound network requests, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates a least-privilege and transparency issue: a host agent may permit execution without clearly surfacing that the skill can read secrets and contact external services, increasing the risk of unintended secret exposure or unauthorized data egress.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description is narrowly about generating 3D models from images and text prompts using the 3D AI Studio API. The balance command calls the account wallet endpoint and prints account billing information, which is an additional account-management capability rather than part of conversion itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.