lab-hardware-cad
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill implements a workflow where Python scripts defining CAD models (*_model.py) are imported and executed to generate geometry artifacts. This is accomplished in
scripts/_common.pyusingimportlib.util.exec_module. The skill documentation explicitly warns the agent to verify the contents of any model files supplied from external or untrusted sources before execution, ensuring that the dynamic execution behavior is controlled and transparent. - [EXTERNAL_DOWNLOADS]: The skill setup process involves installing
build123dandmatplotlibfrom standard Python package registries. These are well-recognized and legitimate libraries for 3D modeling and visualization. The skill documentation provides clear instructions for these installations using standard tooling. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied CAD models and geometric data. While these inputs represent a theoretical surface for indirect prompt injection via embedded comments or metadata, the skill provides deterministic validation tools such as
scripts/check.pyandscripts/snapshot.py. These tools require the agent to verify the physical properties and visual appearance of the generated hardware, mitigating the risk of instructions embedded in data influencing the agent's output.
Audit Metadata