implicit-cad
Warn
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill's primary utility scripts, such as
scripts/export.mjsandscripts/snapshot.mjs, usechild_process.spawnSyncto invoke secondary Node.js processes for the package's internal CLI tools. - [REMOTE_CODE_EXECUTION]: The core loading logic in
loader.jsimplements a mechanism to load and execute JavaScript code dynamically viaimport(). This capability is used to load CAD model definitions from local file paths, remote URLs, and Data URLs generated from user-supplied source strings. This allows for the execution of arbitrary logic defined within.implicit.jsfiles. - [EXTERNAL_DOWNLOADS]: The
themeSettings.jsfile references external image assets hosted onstatic.morflax.comwhich are used as environment textures for the Three.js rendering engine.
Audit Metadata