The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The bridge script scripts/freecad-bridge.py starts a local HTTP server on 127.0.0.1:8735 that executes received Python code using exec() and compile(). This is an intended architectural feature allowing the agent to drive FreeCAD via its Python API.
[COMMAND_EXECUTION]: The skill includes scripts/freecad-send.sh, a utility script that uses curl to interact with the local bridge server, enabling the execution of Python files or inline code strings.
[PROMPT_INJECTION]: The skill operates by translating high-level instructions into executable Python scripts for the bridge. It lacks explicit code sanitization or boundary markers, creating a surface for indirect injection (ingestion point: SKILL.md; capability inventory: exec, file-write). Security is managed through local-only binding and a cross-origin check that rejects requests with an Origin header, mitigating browser-based access risks.

freecad