Agentcad Skill V050.Ta0dYt

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:56 AM UTC
• Version: 0.5.0

Overview

This skill is a coherent CAD helper that clearly centers on running the agentcad CLI to create and inspect 3D model artifacts.

Install from a trusted source, consider pinning or verifying the agentcad package when possible, and use --no-view or --no-preview --no-diff --no-view in automation or sensitive environments where browser launches or extra generated files would be disruptive.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:10

Finding

Unpinned Third-Party Packages Enable Supply-Chain Compromise

Content

View full analysis

Vulnerability Details

File Location: README.md:13, README.md:19, README.md:26, and SKILL.md:8
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: Medium

The installation instructions retrieve mutable packages from npm, ClawHub, and PyPI without pinning exact versions, immutable commits, cryptographic hashes, or signatures.

Relevant code from README.md:10-27:

markdown

### skills.sh (Vercel)

```bash
npx skills add jdilla1277/agentcad-skill

ClawHub (OpenClaw)

bash

clawhub install jdilla1277/agentcad

Manually (Claude Code)

Install the CLI and let it drop the skill into your project:

bash

pip install agentcad
agentcad skill install

text

Relevant configuration from `SKILL.md:8`:

```yaml
compatibility: Requires Python 3.10-3.12 and agentcad installed (pip install agentcad).

Technical Analysis

These commands resolve package names or repository identifiers to whatever release is current at installation time. The audited repository contains only documentation and the Skill manifest; it does not contain the externally installed agentcad implementation, a dependency lockfile, package hashes, or signature-verification instructions.

In particular:

• npx skills ... can obtain and execute an npm-hosted CLI that is not pinned in the command.
• clawhub install ... resolves a mutable marketplace entry rather than an immutable reviewed artifact.
• pip install agentcad installs the current PyPI release and its transitive dependency graph without version or hash constraints.
• agentcad skill install subsequently executes functionality supplied by that externally installed package.

Consequently, the code that ultimately runs can differ from the code that was reviewed. A compromised publisher account, marketplace entry, package release, or transitive dependency could introduce attacker-controlled behavior ...[truncated 1374 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every installation command to a reviewed, exact release version or immutable commit.
2. For Python, distribute a constraints or lock file containing exact direct and transitive versions. Where supported, require hashes, for example through pip install --require-hashes.
3. Avoid implicit npx retrieval. Install a pinned version of the required CLI from a trusted registry and invoke that verified installation.
4. Pin marketplace installations to immutable release identifiers or content digests if the marketplace supports them.
5. Publish SHA-256 checksums and cryptographic signatures for release artifacts, and document mandatory verification steps.
6. Protect publisher accounts and release workflows with multi-factor authentication, protected environments, provenance attestations, and narrowly scoped publishing credentials.
7. Generate a software bill of materials and continuously scan direct and transitive dependencies.
8. Run installation and CAD execution in a sandbox or least-privileged environment without unnecessary credentials or access to sensitive host directories.
9. Keep the pinned version in SKILL.md, README.md, and release automation synchronized so users do not fall back to mutable package resolution.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to run npx skills add jdilla1277/agentcad-skill without pinning the skills package to an exact version. This creates a supply-chain risk because npx may fetch the latest published package at execution time, so a compromised or malicious new release of skills could execute arbitrary code during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill explicitly documents that agentcad run writes versioned artifacts and can automatically open a browser, but it does not surface this as a clear warning in the user-facing skill description or operating guidance. In an agent setting, that can cause unexpected filesystem modifications and UI side effects during routine use, which weakens user consent and can be problematic in unattended or sensitive environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.