bambu-print
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/slice_model.pyutilizessubprocess.run()to execute thebambu-studioCLI. The command is constructed using a list of arguments, which is a secure implementation that prevents shell injection attacks. - [EXTERNAL_DOWNLOADS]: The skill constructs and references search URLs for reputable 3D model hosting services, including Printables, MakerWorld, Thingiverse, and MyMiniFactory. These are well-known services and the interaction is limited to standard search query parameters.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external websites which could potentially contain adversarial content intended to influence the agent.
- Ingestion points:
scripts/search_models.pyreturns model names, URLs, and descriptions from external 3D model repositories to the agent. - Boundary markers: No specific delimiters or "ignore" instructions are used when displaying the external metadata to the agent.
- Capability inventory: The skill possesses file writing capabilities and command execution via the
bambu-studioutility inscripts/slice_model.py. - Sanitization: The skill employs
urllib.parse.quoteto sanitize search queries sent to repositories, but it does not filter or sanitize the content retrieved from those repositories for potential prompt injection markers.
Audit Metadata