Search and download ready-to-print 3D model files (STL/3MF/ZIP) for a concept or specific part by querying Printables (first). Use when an agent needs to find an existing model, capture license/attribution, download the source files, and output a local folder + manifest for quoting/printing.

This skill appears to do what it says (search Printables and download models), but you should be cautious before running it: 1) it downloads third-party files and extracts ZIPs without sanitizing filenames — a malicious or malformed archive or a manipulated API response could overwrite files (zip-slip / path traversal). 2) filenames from the API are used verbatim when saving, which could introduce unexpected paths. 3) the script writes to a default folder in your home directory; consider specifying an isolated outdir. Recommended actions: run the script in a sandbox or container, inspect network calls, and review/patch the code before use — specifically: sanitize downloaded filenames (use basename/safe_slug), validate ZIP members and reject entries with absolute paths or '..' components before extraction, enforce max file size and disk quotas, and prefer extracting into an empty, isolated directory. If you only need search results, run the search subcommand first (safe, read-only). If you want me to, I can produce a small patch that hardens ZIP extraction and filename handling.

Type: OpenClaw Skill Name: find-stl Version: 0.1.0 The skill bundle is benign. The `SKILL.md` provides clear, functional instructions without any prompt injection attempts against the agent. The `scripts/find_stl.py` script exclusively interacts with the legitimate `api.printables.com` endpoint to search for and download 3D model files (STL/3MF/ZIP). File system operations are limited to creating output directories and writing/extracting downloaded files to a user-specified or default local path (`~/models/incoming`), which is consistent with its stated purpose. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation.