Drawing Review Skill (审图) 图纸会审预审

• Outcome: Review
• Latest audit: Oct 20, 2026 · 5:44 PM UTC
• Version: 1.2.2

Overview

This skill needs review because mandatory cloud submissions lack a confidentiality check, and its scripts exceed its promised folder limits.

Confirm that the author's cloud service is approved for your project data before using mandatory review, and redact submitted items. Explicitly set output paths and approve or restrict font scans outside the project. Have a qualified person verify conclusions because extraction and checking coverage are incomplete.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tainted flow: 'req' from os.environ.get (line 43, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/ask_api.py (reported line 47)May include surrounding context.

python

headers={'Content-Type': 'application/json',
                                          'X-API-Key': KEY})
    try:
        with urllib.request.urlopen(req, timeout=30) as r:
            return r.status, json.loads(r.read().decode('utf-8'))
    except urllib.error.HTTPError as e:
        body = e.read().decode('utf-8', 'ignore')

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Mandatory cloud prechecks transmit project issue descriptions without an explicit privacy warning.

Medium

• Category: Output Handling
• Confidence: 95% confidence

Finding

The mandatory cloud review submits project issue descriptions through --review --text or --review --file, potentially disclosing confidential design details, material specifications, or contractual issues to an external service. Although cloud use and API-key requirements are disclosed, the skill does not explicitly obtain authorization to transmit project content or explain the destination and data-handling practices; its strong local-access assurances may also obscure this separate disclosure boundary.

Content

No source excerpt is available for this finding.

The skill makes methodology retrieval API-dependent, despite describing methods and workflows as local and cloud access as the judgment engine.

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The file moves essential methodology to a mutable remote service despite the metadata describing local methods and workflows. More importantly, its later instructions require unquestioning compliance with remote responses, creating a trust-boundary weakness: a compromised service could inject instructions or manipulate engineering review criteria and report content. The engineering-review context increases the consequences of silently altered criteria, although no malicious response is shown.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/00-索引.md (reported line 44)May include surrounding context.

方式 B · 直接打接口

bash

curl -X POST "$DRAWING_REVIEW_API/v1/method" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $DRAWING_REVIEW_KEY" \
  -d '{"topic":"five-steps","part":3}'

The web-chat fallback instructs users to submit drawing contents to an AI service without a confidentiality warning.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The web-chat fallback encourages users to paste drawing text or images into an AI service without first checking confidentiality restrictions or whether the service is approved for that data. Engineering drawings, material schedules, and design descriptions can contain proprietary or contractually restricted information, making this omission particularly relevant for the skill's novice audience. Disclosure requires user action; the file does not demonstrate automatic uploading or deliberate exfiltration.

Content

No source excerpt is available for this finding.

The five-step workflow requires cloud access for methods that the manifest describes as locally available.

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The metadata describes locally available methodology, but this file makes detailed methods cloud-only and requires the agent to follow whatever the service returns. That unconditional delegation creates a remote instruction-trust boundary: compromised or manipulated responses could redirect the review or alter its conclusions, while service failure necessarily blocks the workflow. Cloud access itself is not malicious, and this excerpt does not establish sensitive-data transmission or arbitrary code execution.

Content

No source excerpt is available for this finding.

The local demonstration supplies a substantive judgment rule despite the manifest stating that judgment criteria reside exclusively in the cloud.

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The manifest explicitly says local content contains methods and workflows, not judgment criteria. This example nevertheless supplies an actionable criterion—water supply without a drainage annotation means a missing drainage connection—assigns blocking severity, and instructs the reviewer to apply it. Although presented as a demonstration, it enables a substantive local judgment without the declared cloud adjudication step.

Content

No source excerpt is available for this finding.

LEADER extraction omits all block definitions despite the documented mandatory coverage.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The block loop extracts HATCH entities but never LEADER entities, despite the documented requirement to cover block definitions. A drawing containing leaders inside blocks can therefore produce silently incomplete evidence, potentially concealing material-to-region associations from downstream review. This is a review-integrity weakness rather than a code-execution vulnerability, and the engineering pre-review context makes false confidence in extraction completeness consequential.

Content

No source excerpt is available for this finding.

Reference checking excludes reference types despite explicitly claiming to check all references without type filtering.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The checker promises comprehensive reference validation but only examines block xref_path values ending in .dwg or .dxf; other external dependencies, such as image and underlay references, are not covered. Missing dependencies can therefore be omitted from the reported totals, creating misleading assurance about drawing completeness. This is particularly consequential in engineering review, although it is an integrity and coverage weakness rather than evidence of malicious execution.

Content

No source excerpt is available for this finding.

The documented P8 entity-type distribution comparison is not performed.

Medium

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

The script calculates ms_types but never compares it against the baseline, despite documenting an entity-type distribution comparison. Changes that preserve entity, text, layer, and block counts can therefore escape the automated comparison even when important entity types have disappeared or been substituted. The engineering-review context increases the significance of missed changes, while the explicit requirement for visual inspection mitigates—but does not fix—this coverage gap.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/extract_hatch_leader.py (reported line 41)May include surrounding context.

python

else:
                for ed in getattr(path, 'edges', []):
                    for attr in ('start', 'end', 'start_point', 'end_point'):
                        pt = getattr(ed, attr, None)
                        if pt is not None:
                            try:
                                pts.append((round(pt[0], 1), round(pt[1], 1)))