parametric-3d-printing

Pass

Audited by Gen Agent Trust Hub on Jun 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The run_cadquery_model.py utility uses subprocess.run to execute Python scripts generated by the agent. This is the skill's primary functional mechanism, enabling the local generation of 3D geometry and file exports.
  • [COMMAND_EXECUTION]: Multiple test files (tests/conftest.py, tests/test_stl_to_3mf.py, tests/test_run_wrapper.py) utilize subprocess calls to automate validation and testing of the skill's components.
  • [EXTERNAL_DOWNLOADS]: The SKILL.md and README.md files provide instructions for installing well-known CAD and rendering libraries (such as cadquery, trimesh, and pyrender) from official package registries and the CadQuery organization's GitHub repository.
  • [PROMPT_INJECTION]: The skill defines a workflow where external data (dimensions found via web search) is incorporated into the generated Python scripts. This creates a potential surface for indirect prompt injection if malicious data is retrieved, though the risk is mitigated by the agent's role in interpreting the data into valid CadQuery code.
  • Ingestion points: Dimensional data sourced from web searches and entered into the script's parameters (documented in SKILL.md).
  • Boundary markers: Absent; values are placed directly into Python variable assignments and comments.
  • Capability inventory: Local Python execution via subprocess in run_cadquery_model.py and file system writes for STL/3MF/PNG files.
  • Sanitization: None; the agent is relied upon to validate the numeric values during code generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 23, 2026, 04:31 PM
Security Audit — agent-trust-hub — parametric-3d-printing