Sketch2CAD

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:32 AM UTC
• Version: 1.0.0

Overview

This skill has a legitimate sketch-to-DXF purpose, but its converter can execute injected Python through a crafted output filename and installs an unpinned package at runtime.

Review before installing. The skill should not be used until the converter stops building executable Python from filenames, restricts output paths to a controlled DXF output directory, and moves `ezdxf` to a pinned, reviewed dependency installed outside normal runtime.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/convert.py:51

Finding

Arbitrary Python Code Execution Through an Unsanitized Output Path

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/convert.py:24

Finding

Runtime Installation of an Unpinned Third-Party Dependency

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims to process hand-drawn photos automatically, but the documented behavior only converts manually supplied coordinates into DXF. This mismatch can mislead the orchestrator or user into sending images and trusting automated extraction that does not exist, causing unsafe delegation, incorrect outputs, and potential abuse of broader triggers under false pretenses.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill description claims photo/hand-drawn sketch recognition, but the code only accepts explicit coordinate pairs and writes a closed polyline. This is a security-relevant deception/misrepresentation issue because users and orchestrators may grant the skill access or trust under false assumptions about its capabilities, reducing scrutiny of what it actually does. In agent ecosystems, capability mismatch can hide unrelated behavior and undermine safe tool routing.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes shell commands to run a Python script but declares no explicit tool scope or allowed-tools restrictions. In an agent environment, undocumented shell capability weakens least-privilege guarantees and can let the skill execute beyond what users or reviewers expect, especially when paired with dynamic environment setup.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Broad trigger phrases like general requests to 'help draw CAD' can cause the skill to activate in contexts beyond narrow sketch-to-DXF conversion. Overbroad routing increases the chance that a shell-capable skill is selected for unrelated tasks, exposing users to unintended command execution paths or incorrect automation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation condition matches any hand-drawn image mentioning CAD, DXF, or drawings, which is too ambiguous for a shell-using skill. In context, this makes the skill more dangerous because it may be invoked on loosely related content while presenting capabilities it does not actually implement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring title and examples, along with later user-facing output strings, are presented only in Chinese. For a general-purpose conversion script, this imposes a specific language on users without opt-in or a stated region-specific justification, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Installing dependencies from pip at runtime is an unnecessary capability for this skill and exposes the environment to supply-chain compromise, unreviewed code execution, and network-based nondeterminism. Because the stated task is local DXF generation from provided points, fetching packages during execution is broader than required and violates least privilege. The mismatch between minimal functional needs and network/package-management behavior makes this more suspicious in skill context.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/convert.py (reported line 28)May include surrounding context.

python

if not os.path.exists(venv_python):
        print("[sketch2cad] 首次使用，创建虚拟环境并安装依赖...")
        os.makedirs(VENV_DIR, exist_ok=True)
        subprocess.run([sys.executable, "-m", "venv", VENV_DIR], check=True)
        subprocess.run([venv_python, "-m", "pip", "install", "ezdxf", "-q"], check=True)
        print("[sketch2cad] 环境准备完成")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 72% confidence

Finding

The script performs an automatic pip install ezdxf at runtime, which introduces a supply-chain and policy risk by fetching and executing package installation logic during normal skill execution. While there is no direct shell injection here, runtime dependency installation is unjustified for a simple coordinate-to-DXF converter and can allow unexpected code execution through compromised packages, indexes, or network tampering. In an agent skill, this is more dangerous because it grants outbound package-fetching capability unrelated to the user task.

Content

Scanner excerpt · scripts/convert.py (reported line 29)May include surrounding context.

python

print("[sketch2cad] 首次使用，创建虚拟环境并安装依赖...")
        os.makedirs(VENV_DIR, exist_ok=True)
        subprocess.run([sys.executable, "-m", "venv", VENV_DIR], check=True)
        subprocess.run([venv_python, "-m", "pip", "install", "ezdxf", "-q"], check=True)
        print("[sketch2cad] 环境准备完成")
    
    return venv_python

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

The script builds Python source code using unsafely interpolated user-controlled values, including output_path, and then executes it via python -c. Although subprocess.run is invoked without a shell, the dangerous boundary is the generated Python code itself: a crafted filename containing quotes/newlines can break out of the string literal and execute arbitrary Python code in the spawned interpreter. In this skill context, user input is expected and the command runs automatically, making this significantly more dangerous than a normal subprocess wrapper.

Content

Scanner excerpt · scripts/convert.py (reported line 63)May include surrounding context.

python

print("[sketch2cad] DXF已生成: {output_path}")
'''
    
    result = subprocess.run(
        [venv_python, "-c", code],
        capture_output=True,
        text=True

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documentation states that the script will automatically create a virtual environment and install dependencies, adding execution-side effects unrelated to simple file conversion. Automatic setup increases attack surface by introducing package installation and potentially network access during runtime, which is riskier than a fixed local conversion tool.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.