create-cad-files
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/build_cad_file.pyusesrunpy.run_pathto execute a Python file (assembly.py) generated by the agent during the task. This represents runtime execution of agent-generated code derived from user requirements. - [INDIRECT_PROMPT_INJECTION]: The skill processes natural-language requirements to generate executable Python code. Because the skill has the capability to execute this code via
runpy, it is vulnerable to malicious instructions embedded in the user's CAD requirements that could attempt to execute arbitrary commands. - Ingestion points: Natural-language CAD requirements described in
SKILL.mdStep 1. - Boundary markers: No specific boundary markers or sanitization logic are defined for the input processing.
- Capability inventory: Execution of generated Python scripts via
runpy.run_pathand shell command execution. - Sanitization: None identified; the skill relies on the agent's code generation logic.
- [COMMAND_EXECUTION]: The skill instructions in
SKILL.mddirect the agent to execute shell commands to run its internal project management and build scripts. - [EXTERNAL_DOWNLOADS]: The skill suggests installing the
opencad[occt]Python package viapipif it is not found in the environment.
Audit Metadata