acad-palettes-ribbon
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides code templates for building AutoCAD UI components that execute commands based on string parameters. This pattern establishes a potential vulnerability surface where maliciously crafted data could influence application behavior.
- Ingestion points: The
CommandParameterproperty ofRibbonButtonobjects and theExecutemethod ofRibbonCommandHandlerinSKILL.md. - Boundary markers: Absent; there are no delimiters or specific instructions provided to isolate or ignore embedded directives within the command strings.
- Capability inventory: The skill utilizes
doc.SendStringToExecuteinSKILL.md, which grants the ability to perform arbitrary actions within the AutoCAD environment. - Sanitization: Absent; no logic is provided to validate, filter, or escape the command strings before they are processed by the application.
Audit Metadata