bambu-slicer
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a TypeScript CLI to invoke the OrcaSlicer binary via
Bun.spawn. It mitigates potential command injection risks by resolving all user-provided file paths to absolute paths and passing arguments to the process as a structured array rather than a raw shell string. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from MakerWorld, a well-known 3D printing service, through the
agent-browsertool. It incorporates safety guardrails by requiring the agent to show thumbnails and screenshots to the user for approval before downloading any external files. - [DYNAMIC_EXECUTION]: The CLI tool dynamically patches slicer profile JSON files at runtime to ensure compatibility between different software versions. The logic includes a specific security filter to prevent prototype pollution by blocking the assignment of sensitive keys such as
__proto__andconstructorduring object merging. - [EXTERNAL_DOWNLOADS]: The skill facilitates the download of 3D model files from MakerWorld. These downloads are performed as part of the intended functionality and target a well-known service in the 3D printing domain, with instructions emphasizing user oversight during the process.
Audit Metadata