Security audit

bambu-agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local Bambu printer monitoring tool, but it handles printer credentials and telemetry with weak protections that users should review before installing.

Install only if you are comfortable with a local dashboard that auto-starts, monitors your printer farm, and stores printer access codes locally in plaintext. Before use, consider requiring certificate verification or certificate pinning, protecting or moving config.json to a secret store, adding authentication to the APIs, removing serial numbers from responses, and fixing unsafe dashboard rendering.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: main.py:27
Finding: MQTT Credentials Transmitted Without Server Certificate Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: main.py:95
Finding: Printer Access Codes Stored in a Plaintext Configuration File
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: main.py:132
Finding: Unauthenticated Status API Exposes Printer Serial Numbers and Telemetry
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: templates/index.html:211
Finding: DOM-Based Cross-Site Scripting Through Untrusted Printer Telemetry
Content: View full analysis
`

${p.info.name}

${p.state} · ${p.progress}%

`).join(''); } ``` ```javascript document.getElementById('p-percent').innerHTML = `${p.progress}%`; ``` ```javascript const amsGrid = document.getElementById('p-ams'); if (p.ams && p.ams.trays && p.ams.trays.length > 0) { const trays = p.ams.trays[0].tray; amsGrid.innerHTML = trays.map((t, i) => { const isActive = p.ams.active_tray === i; const color = t.tray_color ? '#' + t.tray_color.substring(0,6) : '#333'; return `

${t.tray_sub_brands || '槽位 '+(i+1)}

`; }).join(''); } else { amsGrid.innerHTML = `
未检测到 AMS
`; } ``` ```javascript function updateNotices(notifs) { const container = document.getElementById('notice-list'); container.innerHTML = notifs.map(n => `
${n.name}任务已完成: ${n.task}
` ...[truncated 2440 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Known Vulnerable Dependency: jinja2==3.1.3 — 8 advisory(ies): CVE-2025-27516 (Jinja2 vulnerable to sandbox breakout through attr filter selecting format metho); CVE-2024-56201 (Jinja has a sandbox breakout through malicious filenames); CVE-2024-34064 (Jinja vulnerable to HTML attribute injection when passing user input as keys to ) +5 more

Critical

Category: Supply Chain
Confidence: 98% confidence
Finding: The pinned dependency jinja2==3.1.3 is associated with multiple published advisories, including sandbox breakout and injection issues. If this skill renders templates using untrusted input, these flaws can enable template escape, code execution paths, or cross-site scripting depending on deployment context, making the risk especially serious for any web-exposed or agent-controlled interface.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: fastapi==0.109.0 — 1 advisory(ies): CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

High

Category: Supply Chain
Confidence: 94% confidence
Finding: The pinned dependency fastapi==0.109.0 is flagged with a known vulnerability (CVE-2024-24762). In a requirements file for an agent skill, shipping a version with a published advisory can expose any API surface built on FastAPI to denial of service, input handling, or other framework-level weaknesses depending on how the skill uses it.
Content: No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

Category: Supply Chain
Confidence: 70% confidence
Finding: Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README instructs users to enter highly sensitive printer credentials, including access codes and serial numbers, and states they will be saved to config.json, but it does not describe secure input handling, file permission restrictions, encryption, or exclusion from source control. In the context of a LAN-connected printer management skill, exposed credentials could allow unauthorized access to printers, monitoring data, or device control if the file is copied, logged, or shared.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to call /api/agent/brief every hour or on status changes for proactive reminders, but it does not clearly disclose this background monitoring or require explicit opt-in. In a LAN-connected device-monitoring skill, this increases surveillance and privacy risk because the agent may continuously observe device state and speak updates without the user fully understanding or consenting to that behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger phrase “帮我看看打印机” is broad and conversational, making accidental activation plausible during ordinary speech. In this skill’s context, activation can cause the agent to query local printer-farm status and announce operational details, which creates privacy and unintended-action risk even if it does not directly control the printers.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Multiple user-visible strings, including printer states, setup prompts, and agent speech output, are fixed in Chinese with no language selection or opt-in mechanism. This is a natural-language policy concern because the skill imposes a specific locale on all users regardless of preference.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The setup wizard stores printer access codes and serial numbers directly in a local JSON file in plaintext. These credentials can be exposed to other local users, backups, logs, or accidental source-control commits, enabling unauthorized access to the printers or disclosure of device-identifying information.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill's name, description, and capability text are entirely in Chinese, and the manifest does not state that the skill is intended only for Chinese-speaking users or offer any language choice. This can violate language/locale policy because it imposes a specific language without documented opt-in or justified regional scoping.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTML root sets lang="zh-CN", and the visible interface text throughout the page is only in Simplified Chinese. Under the policy, forcing a specific language/locale without user opt-in is a natural-language policy violation unless the constraint is explicitly justified or optional.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The README presents the skill entirely in Chinese and the OpenClaw invocation examples are only given in Chinese, which can imply a forced language/locale expectation. Under the policy rule, language constraints should either offer user choice or be clearly documented as a justified regional limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file contains only Chinese-language descriptive comments for the project structure and components. This imposes a specific language in the skill metadata/comments without any indication of user choice or documented locale-specific justification.
Content: No source excerpt is available for this finding.