agentcad
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
agentcadCLI tool from PyPI viapip install agentcad. The package and associated source repositories are vendor-owned resources controlled by the skill author. - [COMMAND_EXECUTION]: The skill instructs the agent to use the
agentcadCLI for project management and geometric operations, including project initialization, measurement, and inspection of 3D models. - [DYNAMIC_EXECUTION]: The core functionality involves the agent generating Python scripts that utilize CAD primitives and APIs, which are then executed through the
agentcad runcommand to produce 3D geometry and metadata. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection through the processing of external CAD files.
- Ingestion points: The
load_step()function in agent-generated scripts and commands such asagentcad inspectandagentcad measureprocess external STEP/BREP files. - Boundary markers: The skill utilizes structured JSON output for tool feedback to the agent to distinguish command output from instructional text.
- Capability inventory: The skill utilizes shell command execution (via the
agentcadCLI), local file system access within the build directory, and execution of generated Python code. - Sanitization: The tool performs geometric kernel validation (e.g., shell closure and manifold checks), though it does not explicitly sanitize for non-geometric prompt injection content that could be embedded in metadata or comments within processed files.
Audit Metadata