cad
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the execution of internal Python scripts (
scripts/step,scripts/inspect,scripts/snapshot) to generate, validate, and document CAD models. These tools are invoked via the CLI and operate on files within the project workspace. - [EXTERNAL_DOWNLOADS]: The skill requires the
playwrightpackage, as specified inrequirements.txt, which is used for headless browser rendering of CAD geometry snapshots. This is a standard dependency for visual automation tasks. - [DYNAMIC_EXECUTION]: The core functionality involves generating and executing Python code that utilizes the
build123dlibrary. The agent authors these scripts based on user requirements and executes them to produce STEP artifacts. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data such as natural language specifications, reference images, and technical drawings. It mitigates risks by implementing a 'CAD brief' workflow that requires the agent to extract and validate dimensions and intent before code generation.
- [SAFE]: Analysis of the snapshot rendering logic in
scripts/snapshot/__main__.pyreveals security best practices, including path validation and origin checks to prevent directory traversal when serving local assets to the browser environment.
Audit Metadata