ClawHub
Back to skill

Security audit

CAD Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent CAD rendering helper, but its setup can expose an unauthenticated code-execution service and builds mutable external code.

Install only if you are comfortable running a local CAD service that executes submitted Python. Bind it to 127.0.0.1, keep it off untrusted networks, stop the container when done, and pin or review the upstream repository commit before building.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:48
Finding

Unauthenticated Python Code-Execution Service Published on All Host Interfaces

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48–76
Vulnerability Type: Unauthenticated network-exposed code execution
Risk Level: High

Vulnerable code snippet:

bash
# Using docker-compose (recommended)
docker-compose up -d

# Or using docker directly
docker run -d --name cad-agent -p 8123:8123 cad-agent:latest serve
bash
curl -X POST http://localhost:8123/model/create \
  -H "Content-Type: application/json" \
  -d '{
    "name": "my_part",
    "code": "from build123d import *\nresult = Box(60, 40, 30)"
  }'

Technical Analysis

The Docker command publishes container port 8123 through -p 8123:8123. By default, Docker binds such a published port to all host interfaces rather than only the loopback interface. Consequently, the service may be reachable by other systems allowed to connect to the host.

The documented /model/create endpoint accepts Python source code in the code JSON property and executes modeling logic inside the container. No authentication, authorization, request signing, source-code validation, or network access restriction is documented. The combination of a broadly published port and an endpoint intentionally executing caller-controlled Python creates an unauthenticated remote code-execution channel.

The server implementation is not included in the audited project, so the presence or strength of any undocumented sandbox cannot be verified. The confirmed exposure should therefore not be assumed safe merely because execution occurs inside a container.

Attack Path

  1. A user starts the service using the documented docker run command.
  2. Docker publishes TCP port 8123 on the host's available network interfaces.
  3. An attacker identifies a reachable host exposing port 8123.
  4. The attacker submits crafted Python through POST /model/create or POST /model/modify.
  5. The server executes the submitted code with the privileges and ca ...[truncated 969 chars]
Remediation
View remediation

Remediation Suggestions

  • Bind the service exclusively to loopback when remote access is unnecessary:

    bash
    docker run -d \
  --name cad-agent \
  -p 127.0.0.1:8123:8123 \
  cad-agent:latest serve

  • Require strong authentication and authorization for all code-execution and model-modification endpoints.

  • Place the service behind an authenticated reverse proxy when network access is required.

  • Execute submitted code in a dedicated, disposable sandbox rather than directly in the long-running API process.

  • Run the container as a non-root user and use a read-only root filesystem.

  • Drop all unnecessary Linux capabilities and enable no-new-privileges.

  • Do not mount the Docker socket, host directories, credentials, or other sensitive resources into the container.

  • Disable unnecessary outbound network access from code-execution sandboxes.

  • Enforce strict CPU, memory, process, disk, request-size, and execution-time limits.

  • Validate model names and request fields, and reject unsupported Python syntax or imports where feasible.

  • Document the service's trust boundary and explicitly warn that it must not be exposed to untrusted networks.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:34
Finding

Unpinned Remote Repository Is Downloaded and Executed During Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34–43
Vulnerability Type: Mutable and unverified upstream dependency
Risk Level: Medium

Vulnerable code snippet:

bash
git clone https://github.com/clawd-maf/cad-agent.git
cd cad-agent
bash
docker build -t cad-agent:latest .

Technical Analysis

The installation procedure clones the current default branch of an external repository without pinning a reviewed commit, tag, or signed release. It then builds the downloaded Docker context. A Docker build can execute commands defined by the upstream Dockerfile and retrieve further dependencies, so following these instructions executes content whose effective behavior can change after this Skill has been reviewed.

HTTPS protects data in transit but does not guarantee that the current repository state matches the version originally audited. Repository compromise, maintainer-account compromise, malicious ownership transfer, or an unsafe upstream update could therefore alter the code and build instructions consumed by future users.

The use of the mutable image tag cad-agent:latest also makes it difficult to identify and reproduce the exact artifact being run.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or another part of its update process.
  2. The attacker modifies the default branch, Dockerfile, build scripts, application code, or dependency declarations.
  3. A user follows the Skill instructions and clones the repository without selecting a trusted revision.
  4. The user runs docker build, causing attacker-controlled build instructions to execute and producing a compromised image.
  5. The user starts the resulting image, allowing the malicious application behavior to run with the container's configured access.
  6. Any secrets, network access, files, capabilities, or host resources made available during the build or container run may fal ...[truncated 617 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the repository to a specific reviewed commit hash rather than relying on the current default branch:

    bash
    git clone https://github.com/clawd-maf/cad-agent.git
cd cad-agent
git checkout --detach <reviewed-commit-hash>

  • Prefer a cryptographically signed release and verify its signature before building.

  • Publish and verify checksums for release archives and expected build artifacts.

  • Record the exact approved commit, dependency lockfiles, base-image digests, and expected image digest in the Skill.

  • Replace mutable base-image and runtime tags with immutable digest references where possible.

  • Review the Dockerfile, build scripts, and dependency changes whenever the pinned revision is updated.

  • Build in an isolated environment without host credentials, sensitive files, privileged mode, or Docker socket exposure.

  • Use dependency scanning and software-bill-of-materials generation as part of the release process.

  • Tag generated images with a version or commit identifier rather than relying only on latest.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

4. Verify Installation

bash
curl http://localhost:8123/health
# Should return: {"status": "healthy", ...}

Static analysis

No suspicious patterns detected.