acad-palettes-ribbon

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill provides code templates for building AutoCAD UI components that execute commands based on string parameters. This pattern establishes a potential vulnerability surface where maliciously crafted data could influence application behavior.
  • Ingestion points: The CommandParameter property of RibbonButton objects and the Execute method of RibbonCommandHandler in SKILL.md.
  • Boundary markers: Absent; there are no delimiters or specific instructions provided to isolate or ignore embedded directives within the command strings.
  • Capability inventory: The skill utilizes doc.SendStringToExecute in SKILL.md, which grants the ability to perform arbitrary actions within the AutoCAD environment.
  • Sanitization: Absent; no logic is provided to validate, filter, or escape the command strings before they are processed by the application.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 02:35 PM