The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/bambu_lan_print.py uses subprocess.run to execute the external bambox CLI tool. The path to this binary can be specified via the --bambox-bin argument, which could be abused to execute arbitrary code if the agent is tricked into using a malicious path.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of .gcode files and .3mf archives. While the instructions emphasize validation, the ingestion of data that can ultimately control physical hardware (3D printers) creates an inherent attack surface for indirect prompt injection.
[EXTERNAL_DOWNLOADS]: The skill instructions advise the agent to install external software like orcaslicer (e.g., via Homebrew) or bambox if missing. This introduces a dependency on external package managers and third-party binaries.
[DYNAMIC_EXECUTION]: The utility script dynamically constructs and executes command-line calls to external tools for model packaging and validation, relying on paths provided at runtime through command arguments.

bambu-labs