engineering-drawing
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill workflow involves the creation and local execution of Python scripts (e.g.,
<name>_drawing.py) using thecadgenlibrary. This is the intended functional design for generating CAD documents from a model. - [EXTERNAL_DOWNLOADS]: The skill requires the
cadgenPython package (version 0.6.6) as specified inrequirements.txt. This is a standard dependency for the skill's functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes geometry data from external STEP files, which serves as an ingestion point for untrusted data.
- Ingestion points: STEP files are read via
cadgen.read_step()as defined in thereferences/sheet-api.mdtemplate. - Boundary markers: The skill processes structured CAD data (STEP) rather than natural language, significantly reducing the surface for prompt injection.
- Capability inventory: Includes file system reading (STEP files), script execution (Python), and file system writing (PDF output).
- Sanitization: Geometry is parsed by the
cadgenkernel, which acts as a validation layer for the structured data format.
Audit Metadata