bambu-studio-ai
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.run()to interface with system utilities such asffmpegfor camera snapshot extraction,blenderfor multi-color model processing, andOrcaSlicerfor CLI-based slicing. It also coordinates between its internal scripts using subprocess calls. All such calls are essential for the primary functionality of the skill. - [EXTERNAL_DOWNLOADS]: User-initiated downloads of 3D models are performed from reputable services including Meshy, Tripo3D, and Printpal. The skill also performs web searches across community model repositories like MakerWorld and Printables. These network operations are necessary for the core user workflows of model sourcing and generation.
- [DYNAMIC_EXECUTION]:
scripts/doctor.pyutilizesimportlib.import_module()to verify the environment's health by checking for installed Python dependencies.scripts/colorize.pyembeds a comprehensive Python script that is executed within a Blender subprocess to handle complex mesh quantization tasks. These dynamic behaviors are restricted to known local scripts and tools. - [INDIRECT_PROMPT_INJECTION]: The skill's search feature retrieves model data from external sources, presenting a theoretical attack surface for indirect instruction injection. This risk is effectively mitigated by the skill's instructions, which mandate that the agent must wait for the user to review the model in Bambu Studio before initiating any print job.
Audit Metadata