Ai Intelligent 3d Model Generation

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:20 AM UTC
• Version: 1.0.0

Overview

The skill describes a plausible AI 3D-generation tool, but its install steps ask users to run unreviewed remote code from a mutable GitHub repository.

Review the GitHub repository and dependency list before installing, prefer a pinned reviewed commit, and run it only in an isolated environment without sensitive files or credentials. Do not upload private images or model assets unless the provider clearly documents processing, storage, and retention terms.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:42

Finding

Unpinned Remote Payload Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42-45
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Medium

bash

git clone https://github.com/openclaw-skills/ai-intelligent-3d-model-generation
cd ai-intelligent-3d-model-generation
pip install -r requirements.txt
python app.py

Technical Analysis

The installation instructions clone a remote Git repository without specifying a reviewed commit hash or signed release. They subsequently install dependencies from the remotely retrieved requirements.txt and execute the retrieved app.py.

Neither the dependency manifest nor the application is included in the audited artifact. The effective executable payload can therefore change after this Skill has been reviewed. If the upstream repository, maintainer account, or referenced dependency supply chain is compromised, the documented workflow can install and run attacker-controlled code.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or a package referenced by its dependency manifest.
2. The attacker modifies app.py, requirements.txt, or an installable dependency to contain a malicious payload.
3. A user follows the instructions and clones the repository's current state without verifying a commit, signature, or checksum.
4. pip install -r requirements.txt runs package installation logic from the unverified dependency set.
5. python app.py directly executes the unverified remote application.
6. The malicious payload operates with the privileges and data access of the user running these commands.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the invoking user's account. The resulting scope may include reading or modifying files accessible to that account, accessing environment variables and locally available credentials, making network requests, and altering the user's development environment. Elevated system-wide ...[truncated 152 chars]

Remediation

View remediation

Remediation Suggestions

• Include the reviewed implementation and dependency lock file directly in the Skill package so that the audited content matches the executed content.
• If remote retrieval is necessary, pin the repository to a specific reviewed commit hash rather than cloning the mutable default branch.
• Verify a trusted release signature or published checksum before installing or executing downloaded content.
• Pin every Python dependency and transitive dependency to an exact reviewed version.
• Require cryptographic hashes for Python packages, such as through a hash-locked requirements file and pip install --require-hashes.
• Disable unnecessary package installation scripts where feasible and obtain packages only from explicitly trusted indexes.
• Run installation and execution in an isolated, least-privilege virtual environment or container without unnecessary credentials, sensitive mounts, or host access.
• Establish a controlled update process in which repository revisions and dependency changes are reviewed before updating the pinned references.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill's natural-language content is entirely in Chinese, including the description and usage sections, with no indication that this is a region-specific skill or that other languages are supported. This can violate language/locale policy when a specific language is imposed without user opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file describes image-to-3D generation, batch processing, and automatic optimization, which imply user-provided images or model data may be uploaded, transformed, or retained. The description does not include any warning or disclosure about how user assets are handled, stored, or transmitted.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.