create-cad-files

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/build_cad_file.py uses runpy.run_path to execute a Python file (assembly.py) generated by the agent during the task. This represents runtime execution of agent-generated code derived from user requirements.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes natural-language requirements to generate executable Python code. Because the skill has the capability to execute this code via runpy, it is vulnerable to malicious instructions embedded in the user's CAD requirements that could attempt to execute arbitrary commands.
  • Ingestion points: Natural-language CAD requirements described in SKILL.md Step 1.
  • Boundary markers: No specific boundary markers or sanitization logic are defined for the input processing.
  • Capability inventory: Execution of generated Python scripts via runpy.run_path and shell command execution.
  • Sanitization: None identified; the skill relies on the agent's code generation logic.
  • [COMMAND_EXECUTION]: The skill instructions in SKILL.md direct the agent to execute shell commands to run its internal project management and build scripts.
  • [EXTERNAL_DOWNLOADS]: The skill suggests installing the opencad[occt] Python package via pip if it is not found in the environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 10:11 AM