cad-viewer
Warn
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill dynamically loads and executes source code from the local workspace to generate CAD model specifications and render complex model definitions.
scripts/viewer/packages/cadpy/src/cadpy/assembly_spec.pyusesimportlib.util.module_from_specandloader.exec_moduleto load and run Python generator scripts found in the model directory.scripts/viewer/packages/implicitjs/src/lib/implicitCad/loader.jsuses dynamicimport()to load JavaScript modules defining implicit CAD models.scripts/viewer/packages/cadjs/src/common/stepModule.jsuses dynamicimport()to load parameter and logic definitions for STEP models at runtime.- [COMMAND_EXECUTION]: The skill executes shell commands and manages subprocesses to configure its environment and run background simulation utilities.
scripts/viewer/moveit2_server/setup.shandscripts/viewer/moveit2_server/run-moveit2-server.shexecutecondaenvironment updates and package installations.scripts/viewer/moveit2_server/moveit2_server/moveit_py.pyspawns a Python subprocess usingsubprocess.Popento execute an internal joint state seeding utility.- [EXTERNAL_DOWNLOADS]: The skill utilizes a browser-based rendering engine that relies on external dependencies for full functionality.
scripts/viewer/packages/implicitjs/package.jsonincludesplaywright@^1.52.0, which typically downloads and executes browser binaries (such as Chromium) on the local system during installation or first run.
Audit Metadata