skills/sakanaai/fugu/cad/Gen Agent Trust Hub

cad

Pass

Audited by Gen Agent Trust Hub on Jul 23, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on the execution of internal Python scripts (scripts/step, scripts/inspect, scripts/snapshot) to generate, validate, and document CAD models. These tools are invoked via the CLI and operate on files within the project workspace.
  • [EXTERNAL_DOWNLOADS]: The skill requires the playwright package, as specified in requirements.txt, which is used for headless browser rendering of CAD geometry snapshots. This is a standard dependency for visual automation tasks.
  • [DYNAMIC_EXECUTION]: The core functionality involves generating and executing Python code that utilizes the build123d library. The agent authors these scripts based on user requirements and executes them to produce STEP artifacts.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data such as natural language specifications, reference images, and technical drawings. It mitigates risks by implementing a 'CAD brief' workflow that requires the agent to extract and validate dimensions and intent before code generation.
  • [SAFE]: Analysis of the snapshot rendering logic in scripts/snapshot/__main__.py reveals security best practices, including path validation and origin checks to prevent directory traversal when serving local assets to the browser environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 23, 2026, 01:58 PM
Security Audit — agent-trust-hub — cad