cadcraft-trace-reference
Warn
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references a download for a portable executable binary (
cadcraft-cli.exe) hosted at a GitHub repository under thestorytoldaccount. - [COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands using the downloaded
cadcraft-cli.exetool to create drawings, manage layers, and generate DXF files. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data in the form of reference images and sketches which influence the subsequent execution of CAD commands.
- Ingestion points: User-provided reference images and sketches described in
SKILL.md. - Boundary markers: The workflow mandates a two-point calibration process and cross-checking of physical dimensions to verify the generated coordinates.
- Capability inventory: The skill possesses the ability to create new files, execute CAD commands via a CLI, and save resulting documents to the file system.
- Sanitization: Implements a coordinate transformation formula (
coordinateRuleincraft-steps.json) to programmatically validate and convert pixel-based input into physical vector coordinates.
Audit Metadata