Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent FreeCAD scripting reference, but it includes an unqualified direct macro execution pattern that can run arbitrary local Python code.
Install only if you want a FreeCAD Python scripting reference. Review generated macros before running them, do not execute macro paths from untrusted sources, and be careful with examples that save, export, delete objects, or install workbench files that run at FreeCAD startup.
The documentation explicitly demonstrates executing arbitrary Python from a filesystem path using exec(open(...).read()) and wrapping the same behavior via FreeCADGui.doCommand. In a skill meant to guide code generation for FreeCAD scripting, this can normalize unsafe patterns and enable an agent or user to run untrusted local code with the full privileges of the FreeCAD process.
The example shows direct macro execution with no warning that a macro is arbitrary Python code, which may lead users or downstream agents to treat it as a routine automation step. In practice, this lowers the barrier to code execution from untrusted files and increases the chance of local code execution, data loss, or persistence if the path is attacker-controlled.
This markdown file includes examples that remove document objects (doc.removeObject) and later writes/exports files (mesh.write, Part.export, Mesh.export) without any accompanying warning that these actions modify user data or overwrite outputs. Under the markdown-specific warning criterion, the skill description should disclose behaviors that can affect user data or system integrity.
This markdown file documents mesh.write(...) operations that write output files, but it does not include any warning or disclosure about creating or overwriting files on disk. For markdown files, SQP-2 applies when the description omits warnings about behaviors that could affect user data or system state, and file writes are explicitly in scope.
This markdown file documents document lifecycle commands such as opening, saving, save-as, and closing documents, which can affect user data on disk. The section presents these operations as examples but does not include any warning about overwriting files, saving changes, or operating on the active document.
No suspicious patterns detected.
