sendcutsend

Pass

Audited by Gen Agent Trust Hub on Jul 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes a Python script (scripts/download_sources.py) that fetches design guidelines and material specifications from cdn.sendcutsend.com. These downloads are used to populate local reference files (sendcutsend-catalog.json, sendcutsend-specs.json) for engineering validation.
  • [COMMAND_EXECUTION]: The skill instructions direct the agent to execute local Python scripts for source management and CAD geometry inspection. It utilizes the build123d and ezdxf libraries to extract physical measurements from user-provided STEP and DXF files.
  • [DATA_EXFILTRATION]: While the skill performs network operations to fetch specifications, there is no evidence of user data or sensitive local environment information being transmitted to external servers.
  • [PROMPT_INJECTION]: The skill processes external data including Markdown and JSON specifications and user-provided CAD files.
  • Ingestion points: External specifications are ingested from references/generated/ after being downloaded; user CAD files are processed during inspection.
  • Boundary markers: The skill does not explicitly define boundary markers for the ingested text but instructs the agent to treat the data as "evidence feeds" rather than authoritative instructions.
  • Capability inventory: The skill has the capability to write to the local file system (references/generated/) and execute subprocesses for CAD analysis.
  • Sanitization: Instructions include explicit mandates to "normalize source facts defensively" and to perform "targeted measurements" rather than relying on unverified source summaries.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 22, 2026, 07:25 AM
Security Audit — agent-trust-hub — sendcutsend