acad-mleaders
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for processing external text data within AutoCAD annotations, creating a potential indirect prompt injection surface.
- Ingestion points: External string data is ingested through assignments to 'MText.Contents' and 'AttributeReference.TextString' as shown in the C# examples in SKILL.md.
- Boundary markers: The skill does not suggest or implement boundary markers or instructions to ignore embedded commands within the ingested text.
- Capability inventory: The skill demonstrates drawing database modification capabilities using 'Transaction.Commit' and 'BlockTableRecord.AppendEntity' across several code snippets in SKILL.md.
- Sanitization: There is no evidence of input validation or sanitization routines for the text content before it is committed to the drawing database.
Audit Metadata