cadcraft-scenario-playbooks
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge between user-specified drafting tasks and structured CAD commands, creating a potential surface for injection if user-provided labels or dimensions contain instructions.\n
- Ingestion points: User-defined geometry specifications, text labels, and dimension values are processed from natural language requests.\n
- Boundary markers: Instructions explicitly require the agent to confirm document units (INSUNITS), check existing标注样式 (dimension styles), and perform a post-generation audit using
drawing.inspectand SVG conversion to verify actual entities.\n - Capability inventory: The skill utilizes the
cadcraft-clifor creating, editing, and inspecting DXF files and performing coordinate-based drawing operations.\n - Sanitization: The skill lacks automated input sanitization but establishes a robust manual verification process where the agent must inspect the physical properties of the generated entities (coordinates, radii, area) against the requested parameters.\n- [COMMAND_EXECUTION]: The skill facilitates the execution of the
cadcraft-clifor local drawing operations.\n - Evidence:
SKILL.mdprovides examples of invokingcadcraft-cli runwith complex JSON-formatted command strings to generate geometry.\n - Context: The command execution is confined to CAD entity generation and file conversion, serving the primary intended purpose of the skill.
Audit Metadata