Security checks across malware telemetry and agentic risk
ShopPrentice appears to be a real Fusion 360 woodworking skill, but it needs review because it installs a local control server that can inspect designs and run Fusion Python scripts without authentication.
Install only if you trust the publisher and want an agent to control Fusion 360 locally. Prefer explicit installer flags for only the client you use, consider skipping MCP unless you need live Fusion execution, stop the Fusion add-in when not in use, and review/clear ~/.shopprentice and temp capture folders if your CAD work is sensitive.
"method": "tools/call",
"params": {"name": tool, "arguments": args},
})
r = subprocess.run(
["curl", "-s", "-X", "POST", MCP_URL,
"-H", "Content-Type: application/json", "-d", payload],
capture_output=True, text=True, timeout=300,flipped_path = base + "_flipped" + ext
if not os.path.exists(flipped_path):
import subprocess
subprocess.run(["sips", "--flip", "horizontal",
image_path, "--out", flipped_path],
capture_output=True)"method": "tools/call",
"params": {"name": tool, "arguments": args},
})
r = subprocess.run(
["curl", "-s", "-X", "POST", MCP_URL,
"-H", "Content-Type: application/json", "-d", payload],
capture_output=True, text=True, timeout=300,65/65 vendors flagged this skill as clean.