c3d-superelevation
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for reading data from Civil 3D
AlignmentandSuperelevationCurveobjects, which introduces a surface for indirect prompt injection if the agent processes data from untrusted CAD files. - Ingestion points: Alignment object properties, such as
sec.Nameand station values, are read from the database into the agent's context as shown in the C# snippets inSKILL.md. - Boundary markers: The provided code snippets do not implement delimiters or instructions to prevent the model from interpreting data content as instructions.
- Capability inventory: The skill demonstrates the use of
SendStringToExecuteto invoke AutoCAD commands andCorridor.Rebuildto modify the state of the CAD drawing. - Sanitization: The documentation does not describe or implement validation, escaping, or filtering for properties extracted from the CAD database.
- [COMMAND_EXECUTION]: The skill illustrates the use of the
SendStringToExecutemethod to run commands within the AutoCAD process. - Evidence: The C# snippet in the 'Creating Superelevation' section uses
acadDoc.SendStringToExecute("SUPERELEVATION ", true, false, false)to trigger the interactive UI wizard. While this instance uses a static string, the method itself provides a high-privilege capability to the agent.
Audit Metadata