gb-cad-figure · 国标工程图绘制引擎

• Outcome: Review
• Latest audit: Aug 8, 2026 · 8:08 PM UTC
• Version: 1.2.1

Overview

The skill is coherent for CAD drawing generation, but its DWG conversion path automatically downloads and runs a third-party executable without integrity checks or an explicit opt-in gate.

Use PDF/DXF generation normally, but treat DWG export as a higher-risk path. Before enabling DWG conversion, prefer a manually installed and verified ODA converter via ODA_IMG, or run the conversion in a sandboxed environment with network and filesystem scope you are comfortable with.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares no permissions, yet the documentation clearly includes shell-capable behavior via script execution and command invocation such as running bash wrappers and system tools. This creates a trust and containment gap: operators may approve or route the skill as low-risk while it can actually invoke local commands and tooling.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: Automatically downloading and executing an external AppImage expands the trust boundary from local drawing generation to remote code retrieval and execution. If the download source, transport, or fetched artifact is compromised, a user invoking DWG conversion could run attacker-controlled code in their environment.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The documented implementation goes beyond drawing generation by downloading and invoking an external binary at runtime for DWG conversion. Pulling executable code during operation expands the supply-chain attack surface and can lead to arbitrary code execution if the source, transport, or artifact integrity is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Automatically fetching the ODA converter is not necessary for the core stated purpose of producing engineering drawings because the skill already generates PDF and DXF directly. Adding a hidden runtime downloader for a large executable introduces unnecessary remote-code and supply-chain risk, especially because the fetch happens implicitly on first DWG conversion.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script silently expands its behavior from local file conversion to network retrieval and installation of a binary dependency at runtime. In a security-sensitive agent context, downloading an external executable that is not pinned, verified, or explicitly consented to creates a supply-chain execution risk that exceeds the stated drawing workflow.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script fetches and then executes a third-party AppImage via AppRun under Xvfb, effectively running untrusted code obtained at runtime. If the source, transport, helper script, or downloaded artifact is compromised, this becomes arbitrary code execution in the agent environment.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script downloads an executable AppImage from the internet at runtime and marks it executable without any integrity or authenticity verification beyond HTTPS. This creates a supply-chain risk: if the remote file, URL target, CDN, or transport trust is compromised, users may execute attacker-controlled code in the course of using the skill.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill’s stated purpose is CAD drawing/template generation, but it includes code to retrieve and prepare a third-party executable for local execution. That expanded capability increases attack surface and is not tightly constrained to data transformation alone, making the skill more dangerous because users may not expect executable installation behavior from a drawing workflow.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The markdown instructs automatic download of an external binary dependency without prominent warning, consent, or security validation requirements. Silent retrieval and execution of external executables can surprise operators and bypass normal review, making accidental execution of untrusted code more likely.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script automatically downloads and prepares an external executable with only brief status messages, giving operators little chance to understand or reject the behavior. In agent workflows, hidden network and execution side effects increase the chance of unsafe execution and violate least surprise.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.