Security audit

engineering-drawing-parser

Security checks for vulnerabilities and agentic risk

Overview

The skill is not destructive or exfiltrating data, but it substantially overstates drawing-parsing capabilities compared with the bundled code.

Install only with the understanding that this appears to be a demo text extractor, not a full CAD/PDF/OCR drawing parser. Use it on text-layer or sidecar test data, verify all extracted engineering values manually, and render previews in a Markdown viewer that blocks raw HTML and remote resources.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/render_preview.py:11
Finding: Unescaped Drawing Data Enables Markdown and HTML Content Injection
Content: View full analysis
Dict[str, str]: out: Dict[str, str] = {} for key, patterns in GB_KEYS.items(): for p in patterns: m = re.search(p, text) if m: # pick first non-None group for g in m.groups(): if g: out[key] = g.strip() break break return out ``` ```python ROW = re.compile( r"^(?P\d{1,3})\s+(?P[A-Za-z0-9./\-]+)\s+(?P[\u4e00-\u9fa5A-Za-z0-9 \-]+?)\s+(?P\d+)\s+(?P[^\s]+)(?:\s+(?P.+))?$" ) def extract_bom( ...[truncated 3152 chars]
Remediation: View remediation
value | injected | columns [deceptive link](https://attacker.example/) ``` 8. Verify that generated output displays each payload as literal text, does not change table structure, and does not create active remote resources. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill advertises broad engineering drawing parsing across DWG/DXF/PDF/image formats, title blocks, dimensions, tolerances, and symbol inventories, but the analysis indicates the implementation only handles a much narrower pre-extracted text/BOM workflow. This mismatch is security-relevant because it can cause users or orchestrators to trust the skill with sensitive drawings under false assumptions about local processing, capability boundaries, and output fidelity.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documents commands that read user-supplied files and write parsed outputs, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent setting, this can lead to over-broad ambient file access and weak policy enforcement, making misuse or unintended file operations harder to constrain or audit.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script’s behavior does not match the advertised capability set: it only reads plain text or a .txt sidecar and never parses DWG, DXF, PDF, or image content directly. In an agent setting, this can mislead downstream systems or users into trusting extracted data from unsupported inputs, causing silent failures, incorrect engineering outputs, or unsafe decisions based on incomplete parsing.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module docstring states that DWG/DXF and image OCR are detected at runtime, but this file contains no code path that invokes such processing. This discrepancy increases operational risk because maintainers, agents, or users may assume non-text drawings are being handled safely when the script is actually substituting a placeholder or sidecar text path.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The pipeline returns only title block, BOM, and dimensions, despite the skill promising tolerance tables and symbol inventories. For engineering drawings, missing these outputs can materially distort the interpretation of a drawing and create false confidence that all required structured data was extracted.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest states that DRAWING_STANDARD defaults to GB for Chinese drawings, which embeds a locale-specific behavior in the skill configuration. While the skill is bilingual, this line still hard-codes a regional default rather than explicitly offering user choice or making the selection purely input-driven.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The entire file is written in Chinese technical labels and content, with no indication that the skill supports other languages or that Chinese is a justified, region-specific requirement. Under the policy rule, forcing a specific language without user opt-in can constitute a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.