acad-cuix-builder
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches an installation script and a compiled utility (CuixBuilder.exe) from official vendor GitHub repositories (autodesk-platform-services and ADN-DevTech). These downloads are required for the skill's primary functionality.
- [COMMAND_EXECUTION]: The skill uses PowerShell to invoke the downloaded CuixBuilder binary, passing a dynamically generated JSON configuration file to the executable to perform the build task.
- [REMOTE_CODE_EXECUTION]: The instructions include a fallback mechanism that clones the generator's source repository from GitHub and executes the project using the dotnet CLI if the binary is missing.
- [INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface where plain-English button labels and commands are processed into a CUIX manifest. Ingestion points: User-provided button labels and command strings in SKILL.md. Boundary markers: None. Capability inventory: Execution of shell commands, binary execution, and file system write operations. Sanitization: No explicit input sanitization or escaping of the user-provided command strings is described prior to JSON serialization.
Audit Metadata