geospatial-converter
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/dxf_to_dwg.pyinvokes external CAD conversion tools (ODAFileConverteranddwgwrite) viasubprocess.run. These calls are implemented using argument lists rather than shell strings, which effectively prevents command injection vulnerabilities. The script also safely identifies the location of these tools using environment variables and standard system paths. - [EXTERNAL_DOWNLOADS]: The skill's documentation and scripts reference the Open Design Alliance (ODA) official website for downloading the ODA File Converter. This is a well-known industry standard tool for CAD processing, and the reference is provided for manual installation by the user.
- [INDIRECT_PROMPT_INJECTION]: The skill processes various geospatial data formats (XLSX, CSV, KML, Shapefile, DXF) from potentially untrusted sources.
- Ingestion points: Data enters the system via
tabular_to_shapefile.py,convert.py,kml_image_overlay.py,shapefile_to_dxf.py, anddxf_to_dwg.py. - Boundary markers: The instructions guide the agent to perform extensive validation of input data, including checking coordinate ranges, header names, and record counts.
- Capability inventory: The skill has the ability to write transformed geospatial files to disk and execute local CAD conversion binaries.
- Sanitization: The skill uses mature, standard library parsers (CSV, JSON, XML) and well-known third-party libraries (
openpyxl,ezdxf,pyshp) which provide robust handling of these file formats.
Audit Metadata