cadcraft-dimension-part
Warn
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The configuration file references/craft-command-evidence.json points to a remote ZIP file containing an executable binary (cadcraft-cli.exe) at https://github.com/storytold/cadcraft/releases/download/v0.7.0/cadcraft-0.7.0-windows-x64-portable.zip. The host account 'storytold' is not a recognized trusted vendor or organization.
- [COMMAND_EXECUTION]: The skill instructions in references/craft-methods.md direct the agent to execute shell commands using the cadcraft-cli tool. It also suggests the use of npx for installing related skills.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process external user materials (CAD files) to perform dimensioning tasks. There is a risk that these files could contain embedded instructions designed to influence agent behavior. Ingestion points: SKILL.md; Boundary markers: Not present; Capability inventory: Use of execute via MCP and shell command execution via cadcraft-cli; Sanitization: No explicit sanitization described.
Audit Metadata