GcadClaw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:07 AM UTC
• Version: 1.0.0

Overview

The skill's CAD automation purpose is coherent, but installation depends on an unpinned PyPI package installed with upgrade behavior, so users should review it before installing.

Install only in a project/work directory you intend to let the skill write into, and review or pin the pygcadwin dependency before running setup. Avoid running the installer from an elevated terminal, because it retrieves and upgrades code from PyPI without exact version or hash verification.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup_python_env.py:10

Finding

Unpinned Third-Party Package Is Installed and Upgraded Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: scripts/setup_python_env.py:10-28; related dependency declarations at requirements.txt:1, SKILL.md:92,127, and references/2d-pygcadwin-workflow.md:23-24
Vulnerability Type: Unverified and unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

python

PYPI_PACKAGE = 'pygcadwin'


def run(cmd: list[str]) -> None:
    print("+", " ".join(cmd))
    subprocess.check_call(cmd)


def main() -> int:
    parser = argparse.ArgumentParser(description="Install skill Python packages from PyPI.")
    parser.add_argument(
        "--allow-network",
        action="store_true",
        help="Accepted for compatibility; this installer always uses PyPI.",
    )
    parser.parse_args()

    run([sys.executable, "-m", "pip", "install", "--upgrade", PYPI_PACKAGE])
    return 0

The corresponding requirement also permits any future compatible release:

text

pygcadwin>=0.1.0

The workflow documentation recommends another unconstrained installation:

powershell

pip install pygcadwin

Technical Analysis

The setup script invokes pip install --upgrade pygcadwin against the public Python Package Index without pinning an exact reviewed version or validating package hashes. The requirements file only defines a lower bound, so later versions may be selected without further review.

Python packages can execute code during installation through build backends and during subsequent imports. Consequently, the effective code executed by this Skill can change after the Skill itself has been audited. The unconditional --upgrade option increases exposure by replacing an already installed and potentially reviewed release with the newest available release.

The --allow-network argument does not provide a security boundary. It is parsed but never checked, and the help text explicitly states that the installer always uses PyPI. Thus, running the setup script performs network-dependent ...[truncated 1935 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin an audited release exactly instead of accepting arbitrary future releases:

   text

   pygcadwin==0.1.0
   

2. Verify distribution integrity with hashes. Generate a locked requirements file containing hashes and install it using:

   text

   python -m pip install --require-hashes -r requirements.lock
   

3. Lock transitive dependencies so that all installed artifacts—not only the direct dependency—have reviewed versions and hashes.

4. Remove --upgrade from the normal installation path. Updating dependencies should be a deliberate maintenance operation followed by security review and testing.

5. Enforce explicit network authorization. Either remove the misleading --allow-network argument or make installation fail unless it is supplied:

   python

   args = parser.parse_args()
   if not args.allow_network:
       parser.error("Network access requires --allow-network")
   

6. Prefer a controlled package source for production use, such as an internal index containing reviewed artifacts. Configure pip to use only that index and disable unintended additional indexes.

7. Apply the same version constraint in every installation instruction, including SKILL.md and references/2d-pygcadwin-workflow.md, to prevent users from bypassing the lock through documented unconstrained commands.

8. Run dependency update checks in an isolated environment and review package provenance, release signatures where available, artifact hashes, dependency changes, and runtime behavior before updating the lock file.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to perform CAD drawing automation, but the actual instructions include installing pygcadwin from PyPI and running setup scripts, which introduces a supply-chain and execution risk not clearly declared in the behavior summary. Users may trust the skill as a drawing utility while it also performs package retrieval and code execution, creating a mismatch that can hide risky setup behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README says users only need to describe requirements in Chinese or English, which is a natural-language locale constraint. For the policy category, language restrictions should either be optional, user-selectable, or clearly justified as region-specific; that is not provided here.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares powerful tools (python, exec, filesystem) and instructs writing files and running scripts, but it does not define a restrictive tool scope such as allowed tools or permissions. That increases the chance of overbroad execution, unintended file modification, or shell use beyond the CAD workflow, especially because the workflow includes environment setup and local script execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file includes a Chinese-language description that defines the skill's purpose, but there is no indication that users can opt into this language or select an alternative locale. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/setup_python_env.py (reported line 15)May include surrounding context.

python

def run(cmd: list[str]) -> None:
    print("+", " ".join(cmd))
    subprocess.check_call(cmd)


def main() -> int:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The natural-language text says the PNG screenshot feedback is mandatory and cannot be skipped. This imposes a specific behavior that may affect user privacy or workflow without documenting any user choice, exception, or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file explicitly states that each drawing task produces files such as brief.md, actions.jsonl, PNG screenshots, feedback reports, and a final DWG. Because the skill affects user data and filesystem state, the description should clearly warn users that executing it will create and modify files in the working environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file contains multiple runnable example prompts that direct the skill to persist output to disk, starting with 'Save as a DWG file.' Writing files can affect user data or the filesystem, but the examples provide no warning or disclosure about file creation/overwrite behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The prompt explicitly tells the skill to save a generated drawing as a DWG file. The markdown does not warn users that running the example will write files, which is the kind of behavior that should be disclosed in skill documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The workflow explicitly directs the agent to create multiple local artifacts such as brief.md, actions.jsonl, screenshots, JSON evidence, and .dwg outputs, but it does not require notifying the user or obtaining consent before writing to disk. In an automation skill that may be run on a user's workstation, silent filesystem modification can cause unintended data creation, clutter, or writes to sensitive locations if paths are influenced elsewhere in the workflow.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is only lower-bounded and not pinned, so installs may resolve to different future versions of pygcadwin with unreviewed changes or newly introduced malicious code. In an automation skill that generates and modifies CAD drawings and likely interfaces with a local CAD application, a compromised or breaking dependency could affect file integrity, system behavior, or introduce supply-chain risk.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

pygcadwin>=0.1.0

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/capture_feedback.py (reported line 15)May include surrounding context.

python

def _safe_attr(entity: Any, name: str) -> Any:
    try:
        value = getattr(entity, name)
    except Exception:
        return None
    if isinstance(value, (str, int, float, bool)) or value is None:

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes a skill for generating, modifying, validating, and repairing GstarCAD 2D drawings via pygcadwin. This setup script invokes pip to install a package from PyPI, which is a software installation/network bootstrap capability rather than a drawing-related function justified by the skill's user-facing purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The CLI exposes an --allow-network flag whose help text implies network access is conditional, but the script always performs a PyPI install regardless. This can mislead operators and policy enforcement tooling into believing network use is gated when it is not, resulting in unexpected outbound access in restricted environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest description is written only in Chinese and provides no indication that the skill supports other user languages or that Chinese is a required locale. Per the policy, forcing a specific language without user opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.