Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its stated local DWG quantity-reporting purpose, but it under-discloses automatic execution of a validator found through environment/local skill paths.
Install only if you trust the local cad-file-reader skill and any CAD_SKILL_DIR path in your environment. Treat --cad-measurement as capable of launching cad-file-reader's cad_validate.sh, and run it only on intended local files in a controlled workspace. Review output paths because JSON/XLSX files are written locally and may overwrite existing files.
This markdown file is entirely written in Chinese, starting with the title at L01, with no indication that language selection is optional or that the skill is region-specific. Under the policy rule for natural-language violations, forcing a specific language without opt-in is a reportable locale-policy issue.
The README’s instructional content and usage guidance are entirely in Chinese, which effectively forces a specific language for users without stating that the skill is region- or language-specific. Under the policy, a skill should not impose a locale/language constraint unless it is explicitly justified or offers user choice.
The skill documentation includes executable shell commands and references to scripts that read DWG/JSON files and generate XLSX output, but it does not declare any explicit tool restrictions such as allowed-tools or permissions. In an agent setting, this creates unnecessary capability ambiguity: a host may permit shell, file reads, writes, or environment access broader than intended, increasing the risk of unintended file access or command execution if the skill is invoked on untrusted inputs.
This JSON file’s purpose and all operational guidance are written only in Chinese, which effectively constrains use to a specific language/locale. The file does not indicate any user choice, opt-in, or documented justification for restricting the skill to Chinese-language operation.
This Python file contains user-facing natural-language content almost entirely in Chinese, including the module docstring, worksheet labels, status messages, and argparse help text. That effectively constrains the skill's interface to a specific language without any visible opt-in or alternative locale selection, which matches the language/locale policy violation criteria.
The code performs environment-based discovery of another skill directory and executes its script, which is behavior outside the manifest's described extraction/reporting role. Hidden cross-skill execution reduces transparency and can enable privilege/trust-boundary violations if the discovered dependency is swapped or poisoned.
The skill's stated purpose is quantity extraction and reporting, but it also invokes an external shell validator script. That expands the attack surface beyond expected data processing behavior and makes the skill more dangerous because untrusted input handling now includes execution of external code paths unrelated to core functionality.
The code executes an external program via subprocess using a path derived from environment-controlled discovery logic. Although it passes an argument list rather than a shell string, it still allows execution of an attacker-selected script or binary if CAD_SKILL_DIR or the discovered directory is manipulated, which is arbitrary code execution in the context of the running user.
if not validator.exists():
return {}
try:
r = subprocess.run([str(validator), path], capture_output=True, text=True, timeout=180)
except Exception as exc:
return {"ok": False, "errors": [f"{type(exc).__name__}: {exc}"]}
errors = []
There is a tainted flow from os.environ.get("CAD_SKILL_DIR") into subprocess.run through path construction, enabling environment-based control over what executable is launched. In agent or CI contexts, environment variables are often easier to influence than code, so this creates a practical arbitrary-command execution vector despite not invoking a shell.
if not validator.exists():
return {}
try:
r = subprocess.run([str(validator), path], capture_output=True, text=True, timeout=180)
except Exception as exc:
return {"ok": False, "errors": [f"{type(exc).__name__}: {exc}"]}
errors = []
The natural-language fields throughout the JSON are written entirely in Chinese, and there is no indication that users may select another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified.
This JSON file includes natural-language values in Chinese for the riser example name and note. Because the file provides no indication that the skill is region-specific or that users can choose their language/locale, it may impose a specific language without user opt-in.
The script creates and saves an .xlsx file to a user-supplied path via wb.save(out). While it prints the path after saving, there is no prior confirmation, warning comment, or help text about the file-write side effect or possible overwrite behavior of the chosen output path.
The CLI does not clearly disclose that providing --cad-measurement may trigger execution of an external validator script discovered from the environment or local skill directories. Lack of disclosure is not the root issue, but in this case it compounds the hidden execution behavior and makes risky side effects harder for users to evaluate.
The module docstring is written entirely in Chinese and provides the usage instruction only in that language. For a general-purpose test script, this can amount to a language/locale policy issue because it does not offer an alternative language or indicate that the script is intentionally region-specific.
No suspicious patterns detected.