The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's setup instructions direct the user or agent to install the cad utility using highly insecure command patterns: curl -fsSL https://texttocad.dev/install.sh | sh on macOS/Linux and irm https://www.texttocad.dev/install.ps1 | iex on Windows. These methods download and immediately execute code from a remote server without any integrity verification or opportunity for review, representing a direct path for arbitrary remote code execution from a non-trusted source.
[DATA_EXFILTRATION]: Documentation within the skill reveals that CAD models are "built by text-to-cad's server." This design implies that the tool transmits part geometry or model-building scripts to a remote third-party infrastructure (texttocad.dev) for processing. This presents a substantial risk of exposing sensitive or proprietary intellectual property to an external entity without explicit security guarantees.
[DYNAMIC_EXECUTION]: The intended workflow requires the agent to generate Python scripts (e.g., <name>_drawing.py) based on templates and then execute them using the cad run command. This constitutes dynamic execution of locally generated code, which could be exploited if the generation process is influenced by untrusted input.
[COMMAND_EXECUTION]: The skill heavily relies on executing the cad command-line interface and its various subcommands (cad run, cad doctor) to perform its primary functions. Since this CLI tool is obtained from an unverified external source via an insecure installation script, all subsequent command executions inherit the associated risks.

engineering-drawing