Fbx To Glb Skill Repo

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:59 AM UTC
• Version: 1.0.1

Overview

The skill appears to be a real FBX-to-GLB converter, but users should review its unverified external dependency and install paths before trusting it with private model files.

Install only from a versioned release you can verify, prefer pinned dependencies or a lockfile, and avoid using the deployed web page for confidential models unless Three.js and all WASM assets are vendored or otherwise integrity-verified.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: assets/web/index.html:202

Finding

Remote Browser Dependencies Execute Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: assets/web/index.html:202-203
Vulnerability Type: Remote executable JavaScript loaded at runtime without integrity verification
Risk Level: High

Vulnerable Code

json

"three": "https://unpkg.com/three@0.184.0/build/three.module.js",
"three/addons/": "https://unpkg.com/three@0.184.0/examples/jsm/"

Technical Analysis

The web converter imports executable JavaScript directly from the unpkg.com third-party CDN. Although a package version is present in the URL, the resources are not bundled with the application and are not protected by Subresource Integrity or an equivalent cryptographic verification mechanism.

These modules execute in the same browser origin and JavaScript context as the converter. Consequently, they can access the in-memory FBX input, converted GLB data, DOM, browser storage available to the origin, and network APIs. Loading remote executable code is not required for the declared local-only conversion functionality because the dependencies can be vendored and served with the other static assets.

This also weakens the application's claim that conversion is entirely local: model bytes are processed locally by the reviewed application code, but externally controlled JavaScript executes in the processing context.

Attack Path

1. An attacker compromises the CDN, the upstream package publication account, package resolution infrastructure, or the hosting path.
2. A user opens the deployed converter while the compromised resource is being served.
3. The browser downloads and executes the modified module in the converter's page context.
4. The user selects a confidential FBX file.
5. The malicious module reads the model data from application state or intercepts file-processing operations.
6. The module transmits the model or derived data to an attacker-controlled endpoint or modifies the generated GLB.

Impact Assessment

Successful ...[truncated 401 chars]

Remediation

View remediation

Remediation Suggestions

1. Vendor the exact Three.js and addon files under assets/web/ and serve them from the same reviewed release.
2. Record and verify cryptographic hashes of all vendored artifacts during the build and release process.
3. If remote hosting remains necessary, use immutable content-addressed URLs and enforce Subresource Integrity where technically supported.
4. Add a restrictive Content Security Policy that limits script-src and connect-src to explicitly required origins.
5. Remove unnecessary outbound network privileges so converter code cannot transmit model data.
6. Include dependency versions and checksums in release documentation and automate dependency provenance verification.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38

Finding

Unpinned npm Dependency Allows Unreviewed Code Changes

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:38
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

bash

npm install assimpjs

The same unpinned installation guidance is repeated in the troubleshooting instructions at SKILL.md:114.

Technical Analysis

The installation command does not specify an exact assimpjs version, and the project contains no reviewed lockfile or package manifest that constrains dependency resolution. The installed package can therefore change over time without any corresponding change to the audited Skill.

Node.js packages can execute code during installation through lifecycle scripts and later execute with the privileges of the Node.js process when loaded by scripts/convert.js. The dependency is legitimately required for conversion, but allowing an unconstrained version exceeds the minimum supply-chain trust necessary for that functionality.

Attack Path

1. An attacker compromises the upstream npm package, its maintainer account, or the relevant package-distribution infrastructure.
2. The attacker publishes a malicious version that satisfies the unconstrained installation request.
3. A user follows the Skill instructions and runs npm install assimpjs.
4. Malicious code executes through an installation lifecycle script or when scripts/convert.js calls require('assimpjs').
5. The malicious package accesses files, model contents, environment data, or network resources available to the Node.js process.

Impact Assessment

Exploitation can provide code execution under the account running npm or the converter. The package could read the selected FBX file, modify GLB output, access other user-readable files and environment variables, or make outbound network requests. The exact scope is bounded by the operating-system permissions and sandboxing applied to Node.js.

Remediation

View remediation

Remediation Suggestions

1. Create a package.json with an exact dependency version rather than a range.
2. Commit a lockfile generated by a trusted package manager.
3. Direct users to run a lockfile-enforcing command such as npm ci instead of resolving the current package dynamically.
4. Verify package provenance, integrity hashes, maintainership, and lifecycle scripts before release.
5. Use automated dependency scanning and controlled update review.
6. Run conversion in a restricted environment without unnecessary credentials, sensitive environment variables, or unrestricted filesystem access.

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:9

Finding

Mutable Latest Release Archive Is Imported Without Cryptographic Verification

Content

View full analysis

Vulnerability Details

File Location: README.md:9
Vulnerability Type: Mutable remote Skill payload retrieval
Risk Level: High

Vulnerable Code

markdown

1. Download [fbx-to-glb.zip](https://github.com/zzh448/fbx-to-glb-skill/releases/latest/download/fbx-to-glb.zip)

Technical Analysis

The installation instructions direct users to download a Skill archive through a mutable latest release URL associated with an individual GitHub account. No fixed release version, commit identifier, checksum, signature, or provenance verification procedure is supplied.

Because the archive is imported into WorkBuddy as Skill content, a future or compromised release may contain different instructions and executable scripts from those reviewed in this audit. The effective installed payload can therefore change after review. Using GitHub rather than an unknown paste service reduces some transport risk but does not establish artifact immutability or authenticity.

Attack Path

1. An attacker compromises the repository owner account, release publishing credentials, or release workflow.
2. The attacker replaces or publishes a new latest archive containing malicious Skill instructions or scripts.
3. A user follows the README and downloads the archive without checking a signature or hash.
4. The user imports the archive into WorkBuddy.
5. WorkBuddy loads or invokes the attacker-controlled Skill content.
6. The payload performs actions available to the agent or its execution environment, potentially including unauthorized file access, network communication, or command execution.

Impact Assessment

The archive may contain arbitrary Skill instructions and executable content, so compromise can affect the full set of tools and operating-system permissions granted to the imported Skill or WorkBuddy session. Potential consequences include agent behavior manipulation, access to user-readable files, model theft, outp ...[truncated 246 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the latest URL with a version-specific, immutable release URL.
2. Publish a SHA-256 checksum through an independently protected channel and require verification before import.
3. Sign release artifacts using Sigstore, GPG, or an equivalent verifiable signing mechanism.
4. Pin the archive to a reviewed source commit and document the relationship between the commit and release artifact.
5. Protect release publication with multi-factor authentication, branch protection, and a restricted reproducible build workflow.
6. Advise users not to import an archive if its signature or checksum cannot be verified.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The core purpose of the code does align with part of the description: it is a Node.js command-line FBX-to-GLB converter using assimpjs and local filesystem access. However, the declared description covers two delivery modes (CLI and web deployment with preview), while the supplied code only implements the CLI path. More importantly, the header comments mention an --embed-textures option, but the argument parser and conversion call do not support or apply such an option, so that advertised capability is not represented by the actual behavior. The script also does not itself demonstrate or guarantee the stronger marketing claims of 'lossless' conversion and full preservation of all assets/animation data; it simply delegates conversion to assimpjs. Thus the description overstates capabilities relative to this code chunk, making it a mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

| CLI 转换脚本 | `scripts/convert.js` | Node.js 命令行转换工具 |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

| CLI 转换脚本 | `scripts/convert.js` | Node.js 命令行转换工具 |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

| CLI 转换脚本 | `scripts/convert.js` | Node.js 命令行转换工具 |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

- `assets/web/index.html` — 主页面（拖拽上传 + 3D 预览 + 一键下载）

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

- `assets/web/assimpjs.js` — Assimp WASM JS 绑定

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

方式二：手动安装

bash

mkdir -p ~/.workbuddy/skills/fbx-to-glb
# 将仓库所有文件复制到 ~/.workbuddy/skills/fbx-to-glb/

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README says users can invoke the skill by directly saying phrases like "帮我转一下这个 FBX 文件" and that WorkBuddy will automatically load the skill, but it does not define exact trigger conditions, exclusions, or when similar phrases should not activate the skill. This ambiguity is heightened by mixing file conversion and website deployment requests in the same invocation section, increasing the chance of unintended activation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs use of shell commands, local file access, and network deployment workflows, but it declares no explicit tool scope or permission boundaries. In an agent setting, this can cause the skill to operate with broader-than-necessary capabilities, increasing the chance of unintended file modification, package installation, or remote publishing actions without adequate restriction.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger "3D 模型格式转换" is much broader than the skill’s stated purpose of converting FBX to GLB/glTF. This ambiguity could cause unintended invocation for unrelated model-conversion tasks because the manifest does not define exclusions or narrower constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill documents a force-overwrite option that can replace existing output files without an explicit safety warning. In an automated agent workflow, users may not realize a destination file will be clobbered, which can lead to irreversible data loss or destruction of important assets if paths are mistaken or reused.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This HTML sets the document language to zh-CN, and the page content and metadata are written exclusively in Chinese. Under the policy rule, forcing a specific language/locale without user opt-in or a documented region-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The Open Graph locale is hard-coded as zh_CN, reinforcing a single-locale experience. Because no alternative locale selection or justification is provided elsewhere in the file, this contributes to a language/locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The JSON-LD metadata explicitly sets inLanguage to zh-CN, indicating the application is fixed to one language. Without an opt-in mechanism or a documented reason for a Chinese-only experience, this matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The page imports Three.js and addons directly from unpkg, which creates a supply-chain and privacy risk: visitors contact a third-party CDN despite the tool being described as browser-local, and compromised or altered CDN content would execute in the page origin. In this context, the app processes user-supplied 3D files locally, so any malicious dependency could access those files and exfiltrate data or tamper with conversions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s documentation and runtime help/output strings are entirely in Chinese, including usage instructions and error/help text. This imposes a specific language on all users without offering an alternative locale or opt-in, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill description and all invocation examples are presented in Chinese, including the instruction that users should "directly say" those phrases in WorkBuddy, but there is no indication that other languages are supported or that Chinese is a required locale. This can violate language/locale policy when a skill implicitly constrains user interaction to one language without opt-in or justification.

Content

No source excerpt is available for this finding.