agentcad

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the agentcad CLI tool from PyPI via pip install agentcad. The package and associated source repositories are vendor-owned resources controlled by the skill author.
  • [COMMAND_EXECUTION]: The skill instructs the agent to use the agentcad CLI for project management and geometric operations, including project initialization, measurement, and inspection of 3D models.
  • [DYNAMIC_EXECUTION]: The core functionality involves the agent generating Python scripts that utilize CAD primitives and APIs, which are then executed through the agentcad run command to produce 3D geometry and metadata.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection through the processing of external CAD files.
  • Ingestion points: The load_step() function in agent-generated scripts and commands such as agentcad inspect and agentcad measure process external STEP/BREP files.
  • Boundary markers: The skill utilizes structured JSON output for tool feedback to the agent to distinguish command output from instructional text.
  • Capability inventory: The skill utilizes shell command execution (via the agentcad CLI), local file system access within the build directory, and execution of generated Python code.
  • Sanitization: The tool performs geometric kernel validation (e.g., shell closure and manifold checks), though it does not explicitly sanitize for non-geometric prompt injection content that could be embedded in metadata or comments within processed files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 02:42 PM