skills/earthtojake/text-to-cad/dxf/Gen Agent Trust Hub

dxf

Pass

Audited by Gen Agent Trust Hub on Aug 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: Internal subprocess calls for system configuration and utility execution. The skill uses subprocess.run in scripts/gen/__main__.py to restart the Python interpreter with a fixed hash seed (PYTHONHASHSEED=0) for deterministic DXF generation. It also uses subprocess.Popen in scripts/packages/cadgen/src/cadgen/_internal/node_runtime.py and subprocess.run in scripts/packages/cadgen/src/cadgen/implicit_export.py to manage Node.js builder processes for rendering and exporting tasks. Further subprocess usage is found in scripts/packages/cadgen/src/cadgen/_internal/generation.py for rebuilding stale subcomponents.\n- [REMOTE_CODE_EXECUTION]: Dynamic execution of generator scripts. scripts/packages/cadgen/src/cadgen/_internal/generation_runner.py uses importlib.util.spec_from_file_location and loader.exec_module within the _load_generator_module function to load and execute arbitrary Python code from .dxf.py and .step.py files. While this is the intended mechanism for generating CAD geometry from user-defined scripts, it provides a surface for executing code generated or modified by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 21, 2026, 04:25 PM
Security Audit — agent-trust-hub — dxf