solidcraft-mechanisms
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill contains technical instructions for a CAD-specific MCP server. It follows standard practices for modeling mechanical assemblies and does not exhibit any malicious patterns such as prompt injection, data exfiltration, or obfuscation.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for ingesting design data. Evidence: 1. Ingestion points: Reads design data via 'inspect_design' and 'joint.list' (SKILL.md). 2. Boundary markers: Absent. 3. Capability inventory: Executes CAD operations like 'joint.create' and 'motion.study'. 4. Sanitization: Absent. This surface is mitigated by the instruction to verify results against manual calculations.
- [DYNAMIC_EXECUTION]: The skill utilizes the CAD tool's capability to process mathematical expressions for geometric properties (e.g., 'm*z1/2') and mentions command-line script execution ('solidcraft-cli run'). These are legitimate functional requirements of the SolidCraft toolset.
- [COMMAND_EXECUTION]: The skill documents the use of a command-line interface ('solidcraft-cli') for running scripts and taking snapshots of designs. This is a standard developer-oriented capability for the intended environment.
Audit Metadata