Trust Assessment
bambu-local received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 1 high, 0 medium, and 0 low severity. Key findings include Arbitrary G-code execution via user input, Insecure MQTT communication due to disabled TLS certificate validation.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Arbitrary G-code execution via user input The `send_gcode` function directly embeds user-provided G-code (`args.code`) into an MQTT command without any validation or sanitization. This allows an attacker to send arbitrary G-code commands to the 3D printer, potentially leading to physical damage, fire hazards, or unauthorized operations (e.g., moving print head violently, setting extreme temperatures). Implement strict validation and sanitization for G-code input. Only allow a predefined set of safe G-code commands or parameters. If arbitrary G-code is an intended feature, clearly document the risks and require explicit user confirmation for potentially dangerous commands. | LLM | bambu.py:178 | |
| HIGH | Insecure MQTT communication due to disabled TLS certificate validation The MQTT client is configured to disable TLS certificate validation (`ssl.CERT_NONE` and `client.tls_insecure_set(True)`). This makes the communication between the skill and the 3D printer vulnerable to Man-in-the-Middle (MitM) attacks. An attacker on the local network could intercept sensitive data, including the printer's `ACCESS_CODE`, or inject malicious commands. Enable proper TLS certificate validation. If the printer uses self-signed certificates, provide a mechanism to trust specific certificates or a CA bundle. Avoid `ssl.CERT_NONE` and `tls_insecure_set(True)` in production environments. | LLM | bambu.py:35 |
Scan History
Embed Code
[](https://skillshield.io/report/10cff85ed5440b9a)
Powered by SkillShield