cad-viewer

Pass

Audited by Gen Agent Trust Hub on Aug 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Python's subprocess module to manage internal Node.js builders and robotics simulation components (e.g., in node_runtime.py and joint_state_seed.py). These executions are restricted to the skill's own packaged scripts and are used for system architecture coordination.
  • [EXTERNAL_DOWNLOADS]: The MoveIt2 robotics server component includes a setup.sh script that utilizes conda to download and install required scientific and robotics dependencies from official community repositories (Conda-forge and Robostack).
  • [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface by parsing various complex engineering file formats (STEP, DXF, URDF). While it uses standard industry parsers like OCP and ezdxf, malicious CAD files could potentially attempt to exploit vulnerabilities in these underlying libraries, a risk inherent to all engineering visualization tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 20, 2026, 12:55 AM
Security Audit — agent-trust-hub — cad-viewer