solidcraft-checking

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill contains Python scripts (run.py, compare_step.py, and various test files) that use the subprocess.run function to invoke the solidcraft-cli tool. This is the primary method for performing CAD design checks and automated testing as described in the documentation.
  • [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing external CAD data.
  • Ingestion points: Reads STEP files (via scripts/compare_step.py) and JSON design scripts (via scripts/run.py).
  • Boundary markers: No explicit delimiters or warnings to ignore embedded instructions are present in the processing scripts.
  • Capability inventory: The skill can execute the solidcraft-cli tool and write to the local file system using the --save parameter in scripts/run.py.
  • Sanitization: No sanitization or filtering of the CAD data content is performed before analysis.
  • [EXTERNAL_DOWNLOADS]: Documentation in SKILL.md instructs the user to use the uv package manager to download and run dependencies such as build123d and pytest. These are well-known libraries for CAD and software testing.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 05:33 PM