cad-viewer
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python's
subprocessmodule to manage internal Node.js builders and robotics simulation components (e.g., innode_runtime.pyandjoint_state_seed.py). These executions are restricted to the skill's own packaged scripts and are used for system architecture coordination. - [EXTERNAL_DOWNLOADS]: The MoveIt2 robotics server component includes a
setup.shscript that utilizescondato download and install required scientific and robotics dependencies from official community repositories (Conda-forge and Robostack). - [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface by parsing various complex engineering file formats (STEP, DXF, URDF). While it uses standard industry parsers like OCP and ezdxf, malicious CAD files could potentially attempt to exploit vulnerabilities in these underlying libraries, a risk inherent to all engineering visualization tools.
Audit Metadata