Security audit

Create Dxf

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent local DXF/SVG generator, but untrusted design specs can manipulate the generated DXF structure through unvalidated layer names.

Review before installing if you expect to process specs from other people or automated sources. Use trusted specs, keep default/simple layer names, write to a dedicated output directory, and inspect generated DXF/SVG files before RFQ or manufacturing use. A hardening update should validate layer names and warn before overwriting outputs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/create_dxf.py:204
Finding: Unsanitized Layer Names Permit DXF Structure Injection
Content: View full analysis
List[str]: return [ "0", "CIRCLE", "8", layer, "10", f"{x:.6f}", "20", f"{y:.6f}", "30", "0.0", "40", f"{r:.6f}", ] def dxf_lwpolyline(layer: str, verts: List[Tuple[float, float, float]], closed: bool = True) -> List[str]: # verts: [(x,y,bulge), ...] out = [ "0", "LWPOLYLINE", "8", layer, "90", str(len(verts)), "70", "1" if closed else "0", ] ``` ### Technical Analysis DXF is a line-oriented format consisting of alternating group-code and value records. The application treats layer names as trusted values and places them directly after DXF group code `8`. Because no validation rejects c ...[truncated 2202 chars]
Remediation: View remediation
str: if not isinstance(value, str): raise ValueError(f"{field} must be a string") if not _DXF_LAYER_RE.fullmatch(value): raise ValueError( f"{field} must contain only letters, digits, underscore, " "period, or hyphen and must be 1-64 characters long" ) return value ``` 2. Replace direct string conversion with explicit validation: ```python layer_profile=validate_dxf_layer_name( layers.get("profile", "CUT_OUTER"), "layers.profile" ), layer_holes=validate_dxf_layer_name( layers.get("holes", "CUT_INNER"), "layers.holes" ), layer_notes=validate_dxf_layer_name( layers.get("notes", "NOTES"), "layers.notes" ), ``` Apply the same validation to `layers.outline`, `layers.etch`, and the top-level polyline `layer` field. 3. Reject carriage returns, line feeds, null bytes, tabs, and other control characters explicitly, even if the allowlist is later relaxed. 4. Do not silently coerce arbitrary values with `str()`. Require actual JSON strings so malformed or nested values fail validation. 5. Add regression tests using layer values containing: - `\n` and `\r\n` - DXF group-code sequences - Null bytes and tabs - Empty strings - Extremely long strings - Non-string JSON values 6. Parse the generated DXF with an independent DXF parser during testing and verify that the number and type of entities exactly match the validated specification. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs users to run local scripts that validate and render files, and the static analysis indicates file read/write capabilities, but the skill manifest does not declare any tool scope such as permissions or allowed-tools. This creates an unnecessary trust gap: consumers cannot easily tell what filesystem access the skill expects, and downstream agents may grant broader access than needed when handling untrusted input specs and output paths.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code performs filesystem changes by creating the output directory and generating two output file paths that are later written. While the script's purpose is to render files, there is no inline confirmation or user-facing warning here about creating or overwriting artifacts in the selected output directory.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.