engineering-drawing

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill workflow involves the creation and local execution of Python scripts (e.g., <name>_drawing.py) using the cadgen library. This is the intended functional design for generating CAD documents from a model.
  • [EXTERNAL_DOWNLOADS]: The skill requires the cadgen Python package (version 0.6.6) as specified in requirements.txt. This is a standard dependency for the skill's functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes geometry data from external STEP files, which serves as an ingestion point for untrusted data.
  • Ingestion points: STEP files are read via cadgen.read_step() as defined in the references/sheet-api.md template.
  • Boundary markers: The skill processes structured CAD data (STEP) rather than natural language, significantly reducing the surface for prompt injection.
  • Capability inventory: Includes file system reading (STEP files), script execution (Python), and file system writing (PDF output).
  • Sanitization: Geometry is parsed by the cadgen kernel, which acts as a validation layer for the structured data format.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 10:24 PM
Security Audit — agent-trust-hub — engineering-drawing