Shopprentice

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:45 AM UTC
• Version: 0.7.1

Overview

The skill is a coherent Fusion 360 furniture-modeling tool, but it installs and exposes powerful local execution paths that need review before use.

Install only if you are comfortable with a local Fusion 360 add-in that can execute generated Python and modify CAD documents. Prefer cloning or downloading a pinned release and inspecting the installer instead of using curl | bash. Run it only in a trusted local environment, keep valuable Fusion documents backed up, and avoid bypassing agent sandbox protections unless you understand the full local-system access being granted.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:26

Finding

Unpinned Remote Installer Is Piped Directly to Bash

Content

View full analysis

Remediation

View remediation

/install.sh echo " install.sh" | shasum -a 256 -c - less install.sh bash install.sh ``` 6. Ensure the installer exits on download and verification failures. Prefer `curl --fail --show-error --location`. 7. Document the exact files and configuration entries modified by installation. 8. Keep the default installation narrowly scoped, and require explicit flags for persistent agent configuration and MCP registration. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: addin/server/mcp_server.py:509

Finding

Unauthenticated Local MCP Endpoint Exposes Arbitrary Python Execution

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: addin/tools/execute_script.py:365

Finding

Remote force_clean Argument Bypasses Destructive Document Safety Checks

Content

View full analysis

dict: """Execute a Fusion API Python script.""" ``` The normal provenance and unsynchronized-change check is skipped whenever the caller supplies `force_clean=True`: ```python # Guard: clean=True destroys the timeline + user parameters. Only allow # it on documents the add-in knows were built by a tracked script AND # have no unsynced UI changes. force_clean=True bypasses the check for # the rare "I really do want to wipe this doc" case. if clean and not force_clean: guard_result = _check_clean_safe(script) if guard_result is not None: return guard_result ``` When cleaning proceeds, the active design is destructively modified: ```python def _clean_design(): """Delete all timeline features and user parameters from the active design.""" import adsk.fusion design = adsk.fusion.Design.cast(app.activeProduct) if not design: return tl = design.timeline for i in range(tl.count - 1, -1, -1): try: item = tl.item(i) entity = item.entity if entity and hasattr(entity, 'deleteMe'): entity.deleteMe() except Exception: pass root = design.rootComponent for i in range(root.occurrences.count - 1, -1, -1): try: root.occurrences.item(i).deleteMe() except Exception: pass params = design.userParameters for i in range(params.count - 1, -1, -1): tr ...[truncated 2708 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (284)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The explicit shell pipeline | bash is the dangerous element that converts downloaded network content directly into executable commands with no validation boundary. In a developer-facing skill, this is especially risky because users may run it in privileged, tool-rich environments where compromise enables persistence, credential theft, or supply-chain tampering.

Content

Scanner excerpt · DEVELOPMENT.md (reported line 23)May include surrounding context.

curl -sSL https://raw.githubusercontent.com/ShopPrentice/shopprentice/main/install.sh | bash -s -- --all

no flags = auto-detect installed clients + MCP

curl -sSL https://raw.githubusercontent.com/ShopPrentice/shopprentice/main/install.sh | bash

text

### OpenClaw install

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

This OpenClaw example uses the same chaining pattern, turning a remote HTTP response into immediate shell execution. The convenience-focused presentation without warnings normalizes unsafe installation behavior and increases the chance users will execute untrusted code blindly.

Content

Scanner excerpt · DEVELOPMENT.md (reported line 31)May include surrounding context.

For OpenClaw users there's a dedicated installer:

bash

curl -sSL https://raw.githubusercontent.com/ShopPrentice/shopprentice/main/install-openclaw.sh | bash

Local clone install

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The curl ... | bash pattern is especially dangerous because it chains retrieval and execution into one step, removing the opportunity for human review and making accidental or malicious remote changes immediately executable. In the context of a skill that also installs client integrations and optionally an MCP server, this could result in broad local-system changes from a single pasted command.

Content

Scanner excerpt · README.md (reported line 32)May include surrounding context.

One command — no clone needed:

bash

curl -sSL https://raw.githubusercontent.com/ShopPrentice/shopprentice/main/install.sh | bash

This installs the woodworking skill for supported clients it detects, including Claude Code and Codex, and optionally sets up the MCP server for live Fusion 360 execution. For installer flags, OpenClaw users, and local clone installs, see DEVELOPMENT.md.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description emphasizes AI-driven furniture CAD generation from user inputs like text, images, or links. This code chunk does not implement or directly invoke any modeling, AI inference, furniture generation, joinery creation, image/link ingestion, or production-ready CAD synthesis. Instead, it initializes infrastructure: module hot-reloading, a localhost MCP server, task/action/session managers, and a parameter editor UI. The file’s own docstring further describes tool-style capabilities such as design introspection, timeline capture, script execution, and screenshots, which are materially different from the declared primary purpose. While this may be part of a larger system, the supplied code chunk’s actual behavior is centered on exposing remote tooling and management services, so the description does not accurately represent this code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description emphasizes AI-driven furniture model generation from prompts, images, or links. This code chunk does not implement model generation, AI interpretation, image/link ingestion, or furniture/joinery creation. Instead, it provides a dockable HTML parameter editor for existing Fusion 360 user parameters, updates parameter expressions, patches those values into a tracked script, optionally saves the script file, and triggers sync/rebuild tasks. These are materially different capabilities from the declared primary purpose, so this chunk is a description/behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied code chunk is package initialization code for a primitives/registry layer. It exposes classes like Tool, Resource, Prompt, Item, and registry accessors, which indicates infrastructure for schema registration rather than functionality for parametric furniture modeling. There is nothing in this chunk suggesting CAD generation, Fusion 360 operations, geometry creation, joinery logic, or multimodal AI input handling. Because the actual code's primary purpose is materially different from the declared description, this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code chunk is a generic metadata/annotation schema helper. Its functions are limited to storing audience, priority, and last-modified fields and converting them to dictionary/JSON form. This is materially unrelated to the declared purpose of parametric furniture modeling in Fusion 360. The primary behavior shown does not implement or support the advertised CAD-generation capabilities in any evident way, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a domain-specific AI skill for generating production-ready furniture CAD models in Fusion 360 from various inputs. The supplied code does not implement any of those capabilities. Instead, it is a small infrastructure utility that wraps MCP primitives with handlers, provides type identification, serialization delegation, and a method to call the handler. There is no evidence of Fusion 360 integration, CAD generation, geometry creation, furniture logic, joinery logic, or multimodal input handling. This is a material purpose mismatch rather than a mere supporting detail.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code chunk is a small utility class for representing and serializing prompt definitions. It manages prompt metadata and arguments and converts them to dictionaries or JSON. There is nothing in this code related to Fusion 360, CAD geometry, furniture modeling, joinery, image/reference-link handling, or AI generation. This is a materially different primary purpose from the declared description, so it is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code chunk is a generic registry utility. It stores, retrieves, lists, counts, and clears items by type (tool/resource/prompt) and exposes a singleton instance with convenience wrappers. There is nothing in this code related to furniture design, CAD model generation, joinery, Fusion 360 APIs, or AI-powered interpretation of user inputs such as natural language, images, or reference links. This is a materially different primary purpose from the declared description, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code chunk is a standalone utility class for representing resource metadata and converting it to dictionaries/JSON. It does not contain any functionality related to Fusion 360, parametric furniture modeling, CAD generation, joinery creation, or multimodal AI input handling. This is a materially different primary purpose from the declared description, so it is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code chunk does not implement furniture design, CAD generation, Fusion 360 integration, AI inference, or processing of user prompts/images/links. Instead, it is a generic utility class for describing tools and their JSON schemas in an MCP-style framework. This is a materially different primary purpose from the declared description, so the description does not accurately represent the code's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about AI-driven furniture CAD generation from prompts, images, or links. This code chunk does not perform model generation, natural-language/image/reference-link processing, or joinery creation. Instead, its primary purpose is to observe Fusion 360 UI command termination events, detect design changes, maintain baselines/cursors, and persist action logs to local files. These are materially different capabilities and include undeclared logging/persistence behavior. While such logging could support a larger CAD-generation skill, this specific chunk’s behavior is not accurately represented by the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This code chunk does not perform AI-powered furniture modeling, natural-language/image/reference-link interpretation, or CAD model generation. Its primary purpose is document/script provenance tracking and sync-state persistence for Fusion 360 sessions. While such tracking could be a supporting subsystem within a larger modeling add-in, the declared description for the skill presents the skill itself as a model-generation capability, which this code chunk does not implement. Additionally, the code writes and reads a sidecar JSON file in the user's home directory, an undeclared resource access not reflected in the declared permissions. Therefore the description does not accurately represent this code chunk's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description is about AI-driven furniture/CAD generation functionality. This code chunk does not implement modeling, natural-language/image/link interpretation, joinery generation, or CAD creation logic. Instead, it provides infrastructure: an MCP-compatible HTTP server, request routing, session management, tool/resource registration and invocation, main-thread execution handling, queueing, and health endpoints. While this could support the overall product, the actual behavior of this chunk is materially different from the declared primary purpose and includes undeclared network-serving/API exposure capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code chunk does not perform AI-powered furniture modeling or CAD generation from natural language, images, or links. Its primary purpose is backend session coordination for a Fusion 360 add-in: tracking MCP sessions, activating the right document, serializing execution, handling ownership conflicts, and preserving per-document state. These are infrastructural capabilities not reflected in the declared description. While such functionality could support a larger furniture-modeling system, this specific code chunk’s behavior is materially different from the declared skill purpose, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents an AI-driven furniture/CAD generation skill, but this code chunk does not perform any furniture modeling, CAD generation, natural-language/image/reference-link processing, or joinery creation. Instead, it provides internal event/task orchestration infrastructure for Fusion 360: starting/stopping a custom event handler, posting tasks, and invoking callbacks on the main thread. This is a materially different primary purpose from the declared functionality, so the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The declared description focuses on AI-driven parametric furniture model generation in Fusion 360. The supplied code does not show that behavior; instead it registers a wide operational toolkit with many capabilities beyond furniture modeling, including executing scripts, syncing/exporting scripts, managing and claiming documents, generating screenshots/product shots/videos, checking queue and document status, and reloading the add-in. Some imported tools could support CAD modeling workflows, but the visible primary behavior here is broad tool registration rather than specifically generating production-ready furniture CAD from natural language, images, or links. This indicates a material description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The supplied code does not implement AI-driven furniture generation, natural-language/image/reference-link processing, or production-ready joinery creation. Instead, it serves as a shared helper export layer for design introspection and structured extraction of existing Fusion 360 model data. While such capture utilities could be supporting infrastructure for a CAD tool, the declared purpose specifically emphasizes generative modeling capabilities, whereas this chunk is about analyzing/capturing model features. That is a materially different behavior for this code chunk, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises an AI-powered furniture modeling tool that creates production-ready CAD models from natural language, images, or links. The provided code does not implement any of those user-facing generation capabilities. Instead, it is a low-level Fusion 360 utility focused specifically on analyzing and capturing properties of existing extrude features, including sketch lookup, profile matching, body-name inference, and participant-body detection via timeline/volume comparisons. While this could be a supporting internal component of a larger CAD system, the code chunk itself materially differs from the declared purpose and exposes an undeclared capability: feature inspection/capture rather than generative furniture modeling.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description emphasizes AI-powered generation of parametric furniture CAD models from user inputs such as natural language, images, or links. The supplied code does not implement any AI, input parsing, furniture-specific modeling, joinery generation, or model creation. Instead, it reads and captures details from existing Fusion 360 features, including mirror planes, move transforms, chamfer/fillet edges, sweep profiles and paths, split-body tools, and removed body names. This is a materially different primary purpose: feature introspection/serialization rather than furniture-model generation. No suspicious extra permissions or triggers are visible in this chunk, but the behavior still does not accurately match the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied code does not implement an AI-powered furniture modeling skill. It is a low-level Fusion 360 utility for reading and inferring properties of rectangular pattern features in an existing design. It extracts direction vectors from CAD entities, rolls the timeline to inspect feature state, gathers bodies and inputs, and detects pattern copies from component bodies. These behaviors are related to CAD internals, but they are materially different from the declared primary purpose of generating furniture models from user prompts, images, or links. There is no evidence here of AI inference, prompt handling, image/link ingestion, furniture-specific logic, or joinery generation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a high-level AI furniture modeling capability that generates production-ready CAD from natural language, images, or reference links. The supplied code does not implement any of that behavior. Instead, it introspects existing Fusion 360 objects and returns structured information about sketch planes and construction plane definitions. While such helpers could support a larger CAD add-in, this chunk’s actual purpose is metadata capture/serialization for planes, not AI-powered furniture modeling or model generation. This is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description promises an AI-powered parametric furniture modeling skill that generates CAD models from natural language, images, or reference links. The supplied code chunk does none of that. Instead, it is a low-level helper for reading and exporting information from an existing Fusion 360 sketch. It captures sketch plane/orientation, curves (lines, arcs, circles, splines), profiles, dimensions, and geometric constraints, and resolves references to projected geometry/BRep entities. This behavior is related to CAD/sketch processing generally, but its primary purpose is analysis/serialization of sketch content for capture or reconstruction, not AI-driven furniture generation or joinery creation. No triggers or permissions are implicated, but the core behavior materially differs from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description presents an end-user AI furniture modeling skill that can create production-ready CAD models from natural language, images, or links. The supplied code chunk instead implements a backend generator that walks already-structured capture_design output and emits Fusion 360 Python scripts. It also provides helpers for variant counting, ambiguity inspection, prefix-only scripts, and single-feature script generation. These behaviors are related to CAD automation in Fusion 360, but they do not match the declared primary capability of AI-driven furniture modeling from unstructured inputs, nor do they show furniture- or joinery-specific functionality. Therefore the description materially overstates and misrepresents what this code chunk actually does.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_deps_anchoring.py:27

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_document_tracker.py:30

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_session_manager.py:28