Security audit

bambuddy

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real Bambuddy API integration, but it gives an agent broad control over printers, smart plugs, settings, and API keys with weak safety and transport guidance.

Review this skill before installing. Use a least-privilege Bambuddy API key, prefer read-only permissions unless you truly need queueing or printer control, require explicit confirmation before deletes, reprints, smart plug toggles, printer stop/resume/pause, settings changes, or API key changes, and avoid sending the API key over plain HTTP except on a tightly controlled local loopback setup.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:28
Finding: API Credential May Be Transmitted over Plaintext HTTP
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 28–39 and 704–721
Vulnerability Type: Transmission of a sensitive API credential over an unencrypted channel
Risk Level: High

The skill sends BAMBUDDY_API_KEY in the X-API-Key request header. Its setup instructions explicitly demonstrate an http:// service URL and permit use of an external URL without requiring HTTPS.

bash
# Convenience alias — reuse this pattern for every call BB_URL="${BAMBUDDY_URL}/api/v1" BB_AUTH="X-API-Key: ${BAMBUDDY_API_KEY}" # GET example curl -s -H "$BB_AUTH" "$BB_URL/system/info" | jq . # POST example curl -s -X POST -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq .

json
{ "skills": { "entries": { "bambuddy": { "enabled": true, "env": { "BAMBUDDY_URL": "http://192.168.1.x:8000", "BAMBUDDY_API_KEY": "bb_your_key_here" } } } } }

text
If Bambuddy is on a remote server, use its external URL or set up a Tailscale/WireGuard VPN.

Technical Analysis

HTTP provides neither transport confidentiality nor server authentication. When BAMBUDDY_URL uses http://, each request carries the reusable API key in plaintext within the HTTP headers. An attacker able to observe or manipulate the network path can capture the X-API-Key header, inspect sensitive responses, modify traffic, or impersonate the Bambuddy server.

The risk is particularly significant on shared wireless networks, compromised local networks, untrusted reverse proxies, or remote connections routed across networks outside the user's control. Quoting shell variables protects against ordinary shell word splitting but does not protect the credential in transit.

Attack Path

A user follows the documented example and configures BAMBUDDY_URL with an http:// LAN or external ad ...[truncated 1379 chars]
Remediation: View remediation
Remediation Suggestions

Require https:// for every non-loopback Bambuddy URL and clearly mark plaintext HTTP as acceptable only for explicitly isolated local development.

Replace the documented http://192.168.1.x:8000 example with an HTTPS URL.

Add a preflight scheme check that refuses insecure remote URLs, for example:

bash
case "$BAMBUDDY_URL" in https://*) ;; http://localhost:*|http://127.0.0.1:*|http://[::1]:*) ;; *) echo "Refusing to transmit BAMBUDDY_API_KEY over insecure HTTP" >&2 exit 1 ;; esac

Configure valid TLS certificates and retain normal certificate verification. Do not recommend curl -k or --insecure.

Where direct TLS is unavailable, require a trusted encrypted tunnel such as WireGuard or Tailscale and explain that an arbitrary external HTTP URL is unsafe.

Provision least-privilege API keys with only the permissions necessary for the intended workflow. Avoid granting printer-control or administrative capabilities to read-only integrations.

Use expiring keys where supported, rotate them regularly, and immediately revoke any key suspected of exposure.

Avoid returning or logging credential-bearing command traces, and ensure shell debugging such as set -x is disabled around authenticated requests.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (32)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill grants broad ability to invoke state-changing Bambuddy API operations, including deleting resources, creating API keys, changing settings, controlling printers, and toggling smart plugs, but it does not instruct the agent to require explicit user confirmation before destructive or safety-relevant actions. In an agent setting, this increases the risk of unintended physical actions, configuration damage, or loss of data from ambiguous or prompt-injected requests.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
md
curl -s -H "$BB_AUTH" "$BB_URL/system/info" | jq . # POST example curl -s -X POST -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # PATCH example

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.
md
curl -s -H "$BB_AUTH" "$BB_URL/system/info" | jq . # POST example curl -s -X POST -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # PATCH example

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.
md
curl -s -H "$BB_AUTH" "$BB_URL/system/info" | jq . # POST example curl -s -X POST -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # PATCH example

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 290)May include surrounding context.
md
curl -s -H "$BB_AUTH" "$BB_URL/system/info" | jq . # POST example curl -s -X POST -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # PATCH example

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 318)May include surrounding context.
md
curl -s -H "$BB_AUTH" "$BB_URL/system/info" | jq . # POST example curl -s -X POST -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # PATCH example

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 352)May include surrounding context.
md
curl -s -H "$BB_AUTH" "$BB_URL/system/info" | jq . # POST example curl -s -X POST -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # PATCH example

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 471)May include surrounding context.
md
curl -s -H "$BB_AUTH" "$BB_URL/system/info" | jq . # POST example curl -s -X POST -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # PATCH example

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 533)May include surrounding context.
md
curl -s -H "$BB_AUTH" "$BB_URL/system/info" | jq . # POST example curl -s -X POST -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # PATCH example

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 557)May include surrounding context.
md
curl -s -H "$BB_AUTH" "$BB_URL/system/info" | jq . # POST example curl -s -X POST -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # PATCH example

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
-d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # PATCH example curl -s -X PATCH -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # DELETE example

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.
md
-d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # PATCH example curl -s -X PATCH -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # DELETE example

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.
md
-d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # PATCH example curl -s -X PATCH -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # DELETE example

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.
md
-d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # PATCH example curl -s -X PATCH -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # DELETE example

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.
md
-d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # PATCH example curl -s -X PATCH -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # DELETE example

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 330)May include surrounding context.
md
-d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # PATCH example curl -s -X PATCH -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # DELETE example

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 361)May include surrounding context.
md
-d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # PATCH example curl -s -X PATCH -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # DELETE example

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 538)May include surrounding context.
md
-d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # PATCH example curl -s -X PATCH -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # DELETE example

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 566)May include surrounding context.
md
-d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # PATCH example curl -s -X PATCH -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"key":"value"}' "$BB_URL/some/endpoint" | jq . # DELETE example

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: This endpoint enables creation of new API keys, effectively minting additional persistent credentials from within the skill. In an agent context, allowing credential creation without strong confirmation and scope restrictions can expand access, bypass intended least-privilege boundaries, and create durable compromise opportunities.
Content: Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.
md
curl -s -H "$BB_AUTH" "$BB_URL/api-keys/" | jq . # Create a new API key curl -s -X POST -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{ "name": "my-key", "can_queue": true,

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: Updating API keys can disable safeguards, rename or manage credentials, and potentially broaden operational abuse if paired with other credential-management flows. While external transmission alone is not the issue, exposing credential-administration actions in the skill materially increases risk.
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
md
curl -s -H "$BB_AUTH" "$BB_URL/api-keys/{key_id}" | jq . # Update an API key curl -s -X PATCH -H "$BB_AUTH" -H "Content-Type: application/json" \ -d '{"name": "updated-name", "enabled": false}' \ "$BB_URL/api-keys/{key_id}" | jq .

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill exposes sensitive endpoints for camera snapshots, support bundles, user listings, API key management, and cloud/notification configuration without warning that these may contain personal data, credentials, internal network details, or surveillance imagery. That omission makes it easier for an agent to retrieve or store sensitive information without user awareness or appropriate minimization.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: This section exposes printer deletion and control commands such as pause, resume, and stop. In the context of physical-device management, these are operationally sensitive actions that can interrupt jobs, waste material, or affect attached hardware, especially when no confirmation or safety gating is mandated.
Content: Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.
md
}' "$BB_URL/printers/" | jq . # Delete a printer curl -s -X DELETE -H "$BB_AUTH" "$BB_URL/printers/{printer_id}" # Printer control (pause, resume, stop) curl -s -X POST -H "$BB_AUTH" -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: Deleting archives and reprinting prior jobs are state-changing actions with potential data-loss and operational consequences. In an agent workflow, omission of explicit consent around these actions makes unintended deletion or wasteful reprints more likely.
Content: Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.
md
"$BB_URL/archives/{archive_id}" | jq . # Delete an archive curl -s -X DELETE -H "$BB_AUTH" "$BB_URL/archives/{archive_id}" # Reprint an archive curl -s -X POST -H "$BB_AUTH" -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.
md
-d '{"name": "Renamed Project"}' "$BB_URL/projects/{project_id}" | jq . # Delete a project curl -s -X DELETE -H "$BB_AUTH" "$BB_URL/projects/{project_id}" # Add an archive to a project curl -s -X POST -H "$BB_AUTH" -H "Content-Type: application/json" \

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Missing User Warnings

External Transmission

External Transmission

External Transmission

Static analysis