solidcraft-checking
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill contains Python scripts (
run.py,compare_step.py, and various test files) that use thesubprocess.runfunction to invoke thesolidcraft-clitool. This is the primary method for performing CAD design checks and automated testing as described in the documentation. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing external CAD data.
- Ingestion points: Reads STEP files (via
scripts/compare_step.py) and JSON design scripts (viascripts/run.py). - Boundary markers: No explicit delimiters or warnings to ignore embedded instructions are present in the processing scripts.
- Capability inventory: The skill can execute the
solidcraft-clitool and write to the local file system using the--saveparameter inscripts/run.py. - Sanitization: No sanitization or filtering of the CAD data content is performed before analysis.
- [EXTERNAL_DOWNLOADS]: Documentation in
SKILL.mdinstructs the user to use theuvpackage manager to download and run dependencies such asbuild123dandpytest. These are well-known libraries for CAD and software testing.
Audit Metadata