c3d-superelevation

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for reading data from Civil 3D Alignment and SuperelevationCurve objects, which introduces a surface for indirect prompt injection if the agent processes data from untrusted CAD files.
  • Ingestion points: Alignment object properties, such as sec.Name and station values, are read from the database into the agent's context as shown in the C# snippets in SKILL.md.
  • Boundary markers: The provided code snippets do not implement delimiters or instructions to prevent the model from interpreting data content as instructions.
  • Capability inventory: The skill demonstrates the use of SendStringToExecute to invoke AutoCAD commands and Corridor.Rebuild to modify the state of the CAD drawing.
  • Sanitization: The documentation does not describe or implement validation, escaping, or filtering for properties extracted from the CAD database.
  • [COMMAND_EXECUTION]: The skill illustrates the use of the SendStringToExecute method to run commands within the AutoCAD process.
  • Evidence: The C# snippet in the 'Creating Superelevation' section uses acadDoc.SendStringToExecute("SUPERELEVATION ", true, false, false) to trigger the interactive UI wizard. While this instance uses a static string, the method itself provides a high-privilege capability to the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 02:35 PM