parametric-3d-printing
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runinrun_cadquery_model.pyand various test files to execute Python scripts. These calls are constructed using specific argument lists rather than shell strings, which follows security best practices for process spawning but still represents a functional execution surface. - [DYNAMIC_EXECUTION]: The core workflow involves the agent generating CadQuery scripts in Python and executing them locally via a provided wrapper script. This is a standard pattern for coding-assistant skills in this domain, and the skill provides structured templates and best practices to guide the generation process.
- [INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to incorporate data from external sources, specifically web search results for product dimensions and 3D scan files (STL) processed via
outline_from_scan.py. While this presents an ingestion surface for potentially untrusted data to influence script generation, the risk is localized to the specialized geometric modeling context.
Audit Metadata