gaggiuino-local

• Outcome: Pass
• Latest audit: Aug 17, 2026 · 11:36 PM UTC
• Version: 3.2.0

Overview

This skill is a disclosed local Gaggiuino machine-control and shot-rendering helper, but users should keep its saved endpoint trusted and be deliberate with settings/profile changes.

Install only if you intend to let an agent talk to and potentially change a real Gaggiuino machine. Keep the saved base URL pointed at a trusted local/LAN device, inspect it with get-base-url if unsure, clear it when moving networks, and require explicit confirmation before profile switches or settings writes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

with open(concat_list, 'w') as f:
            for p in seg_paths: f.write(f"file '{p}'\n")

        subprocess.run(
            ['ffmpeg', '-y', '-f', 'concat', '-safe', '0', '-i', concat_list,
             '-c', 'copy', '-movflags', '+faststart', out_path],
            check=True, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE,

• Confidence: 82% confidence
• Finding: The code generates an ffmpeg concat manifest using unescaped file paths and then invokes ffmpeg with '-safe 0', disabling path safety checks. If a segment path ever contains special characters such as quotes or newline characters, ffmpeg's concat parser may misparse the manifest, potentially reading unintended files or causing unsafe file handling during concatenation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill declares no permissions, yet its content clearly instructs use of shell commands, file reads/writes, environment-sensitive execution, and networked machine control. This creates a capability/permission mismatch that can bypass expected policy review and allows a seemingly low-privilege skill to perform state-changing operations on the host and attached espresso machine.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill metadata says the skill is for status checks, analysis, profile switching/export, and maintenance/settings reading, but the script also exposes update-settings, which can actively modify machine behavior. That mismatch can mislead a user or higher-level agent into invoking a state-changing action under the assumption that the skill is read-only or low-risk.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: The script persists a preferred base URL under the user's home directory, but the skill description does not disclose that it writes local state. Hidden persistence can surprise users and can cause future invocations to silently target a different endpoint than expected.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The review note claims the script talks only to a configured local/LAN API endpoint, but set-base-url accepts arbitrary http:// or https:// URLs without restricting host scope. This enables redirection of all subsequent GET/POST requests, including settings updates and profile changes, to any attacker-controlled remote server, creating an SSRF-like outbound channel and breaking the trust boundary implied by the documentation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: update-settings sends arbitrary JSON directly to the machine settings API with no interactive warning, dry run, or confirmation. Because this skill controls espresso machine behavior, unintended or automated changes could alter temperatures, pumps, scales, or display/system settings and may degrade operation or create safety/maintenance issues.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: set-base-url writes persistent configuration silently, so future runs may use a modified endpoint without a fresh user decision. In a skill that performs network actions and machine control, undisclosed persistence increases the risk of confusing or unsafe follow-on behavior.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script invokes ffmpeg with '-y', which overwrites the destination path without confirmation, including user-specified '--out' locations. In an agent context that may operate on behalf of a user, this can destroy or replace arbitrary files writable by the process and is more dangerous because output paths are accepted directly from input.

External Transmission

Medium

• Category: Data Exfiltration

Content

status=$(curl -sS --max-time "$TIMEOUT" -o "$body_file" -w "%{http_code}" "$url" 2>/dev/null) || curl_rc=$?
  else
    if [[ -n "$data" ]]; then
      status=$(curl -sS --max-time "$TIMEOUT" -X "$method" -H "Content-Type: application/json" -d "$data" -o "$body_file" -w "%{http_code}" "$url" 2>/dev/null) || curl_rc=$?
    else
      status=$(curl -sS --max-time "$TIMEOUT" -X "$method" -o "$body_file" -w "%{http_code}" "$url" 2>/dev/null) || curl_rc=$?
    fi

• Confidence: 88% confidence
• Finding: The POST request path transmits user-supplied JSON and control actions over the network to whatever BASE_URL is configured. In this skill's context that is expected functionality, but because the base URL is user-configurable and not restricted to local/LAN hosts, the transmission can send machine settings or control operations to an unintended remote endpoint.

External Transmission

Medium

• Category: Data Exfiltration

Content

status=$(curl -sS --max-time "$TIMEOUT" -o "$body_file" -w "%{http_code}" "$url" 2>/dev/null) || curl_rc=$?
    else
      if [[ -n "$data" ]]; then
        status=$(curl -sS --max-time "$TIMEOUT" -X "$method" -H "Content-Type: application/json" -d "$data" -o "$body_file" -w "%{http_code}" "$url" 2>/dev/null) || curl_rc=$?
      else
        status=$(curl -sS --max-time "$TIMEOUT" -X "$method" -o "$body_file" -w "%{http_code}" "$url" 2>/dev/null) || curl_rc=$?
      fi

• Confidence: 86% confidence
• Finding: The fallback POST logic repeats outbound transmission to a secondary endpoint when the preferred one fails. While resilience is reasonable, it can duplicate state-changing requests or send them to a different target than the caller expects, especially when persistent base URL state has been modified.

Session Persistence

Medium

• Category: Rogue Agent

Content

- always `get-settings <category>` first
- then make the minimal requested change
- then `update-settings <category> <json>`
- use the settings write rules in this section; use [references/analysis-protocol.md](references/analysis-protocol.md) only for wrapper, connection, and machine-context reminders

#### Mandatory settings-change order

• Confidence: 79% confidence
• Finding: The skill intentionally persists connection state by storing a base URL in `~/.openclaw/workspace/memory/gaggiuino-base-url.json`, and also supports changing settings on the machine. Persistent state can be abused to redirect future requests to an attacker-controlled host or to retain sensitive/local-environment data beyond the immediate session, especially because the skill performs automatic fallback and reuse of saved endpoints.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.