parametric-3d-printing
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
run_cadquery_model.pyutility usessubprocess.runto execute Python scripts generated by the agent. This is the skill's primary functional mechanism, enabling the local generation of 3D geometry and file exports. - [COMMAND_EXECUTION]: Multiple test files (
tests/conftest.py,tests/test_stl_to_3mf.py,tests/test_run_wrapper.py) utilizesubprocesscalls to automate validation and testing of the skill's components. - [EXTERNAL_DOWNLOADS]: The
SKILL.mdandREADME.mdfiles provide instructions for installing well-known CAD and rendering libraries (such ascadquery,trimesh, andpyrender) from official package registries and the CadQuery organization's GitHub repository. - [PROMPT_INJECTION]: The skill defines a workflow where external data (dimensions found via web search) is incorporated into the generated Python scripts. This creates a potential surface for indirect prompt injection if malicious data is retrieved, though the risk is mitigated by the agent's role in interpreting the data into valid CadQuery code.
- Ingestion points: Dimensional data sourced from web searches and entered into the script's parameters (documented in
SKILL.md). - Boundary markers: Absent; values are placed directly into Python variable assignments and comments.
- Capability inventory: Local Python execution via
subprocessinrun_cadquery_model.pyand file system writes for STL/3MF/PNG files. - Sanitization: None; the agent is relied upon to validate the numeric values during code generation.
Audit Metadata