solidworks-fillet-chamfer-cnc
Warn
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill dynamically compiles and executes C# and C++ code at runtime using
scripts/hold_line_bridge.pyto interact with SolidWorks APIs (ISetHoldLines) that are unavailable or unstable via standard Python COM bindings. - Evidence:
scripts/native/HoldLineBridge.cs(C# source),scripts/native/NativeHoldLineAddin.cpp(C++ source), and thebuild_hold_line_bridge/build_native_hold_line_addinfunctions inscripts/hold_line_bridge.py. - [COMMAND_EXECUTION]: The skill executes shell commands to invoke compilers (
csc.exe,cl.exe) and run the resulting compiled binaries. - Evidence:
subprocess.run()calls inscripts/hold_line_bridge.pyto trigger.NET FrameworkandMSVCtoolchains. - [EXTERNAL_DOWNLOADS]: The skill downloads CAD reference files (STEP format) from the FreeCAD-library's official GitHub repository. These downloads are performed with integrity checks using SHA-256 hashes.
- Evidence:
scripts/verify_open_source_complex_case.pyusesurllib.requestto fetch files fromraw.githubusercontent.com/FreeCAD/FreeCAD-library. - [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific parameters from JSON files and geometric data from imported STEP files. While it uses strict validation logic (e.g.,
finite_number,validate_basename), this ingestion of external data constitutes a surface for influence on the agent's tool-calling logic. - Ingestion points:
scripts/cnc_strategy.py(JSON parameters),scripts/verify_open_source_bracket.py(STEP import). - Boundary markers: Uses structured JSON schema and geometric count assertions (e.g.,
expected_source_topology). - Capability inventory: File system writes, SolidWorks COM manipulation, shell command execution via subprocess.
- Sanitization: Employs specific sanitization functions for numerical inputs and file paths.
Audit Metadata