Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward CAD/BIM data extraction helper, with some accuracy and file-output cautions but no evidence of hidden or malicious behavior.
Install only if you are comfortable giving the skill filesystem access to CAD/BIM files and export locations. Treat RVT and DGN support as under-implemented unless verified, and choose output paths carefully because the JSON export example can overwrite files.
The manifest description says the skill extracts element data from Revit, IFC, DWG, and DGN files. In code, convert() only routes IFC to IFCExtractor and DWG/DXF to DWGExtractor, while RVT and DGN are merely recognized by _detect_format() and then rejected as unsupported by raising ValueError.
The stated purpose focuses on conversion and extraction of structured data from CAD/BIM files. The code includes export_to_json(), which performs a filesystem write operation to an arbitrary output path, extending behavior beyond pure in-memory extraction/conversion described in the manifest.
The skill includes an export_to_json method that writes to an arbitrary output path without validation, overwrite protection, or user warning. In an agent context, if output_path is influenced by untrusted input, this could overwrite local files or place data in unintended locations, causing data loss or unauthorized file modification.
This markdown file states that the skill will export extracted data to Excel, CSV, JSON, or DataFrame formats, which is a user-data-affecting operation. The description does not include any user warning about where files are written, whether existing files may be overwritten, or that extracted model metadata will be persisted.
This markdown file discloses that format-specific CLI converters are invoked via subprocess.run(), which affects system integrity and execution context. However, it does not warn users that external executables will be run on their system or note any associated operational implications.
