Security audit
Security checks for vulnerabilities and agentic risk
This drawing-analysis skill needs review because its automatic converter search can run untrusted code from a shared temporary folder.
Prefer a version that removes shared temporary folders from executable discovery. Until then, use DXF inputs or a verified converter on PATH. Expect first-run package downloads and optional local storage of project evidence. Run scrubber --apply only on disposable copies.
scripts/platform_paths.py:268Automatic converter discovery trusts a predictable shared temporary directory
Arbitrary code execution as the user running the Skill, allowing access to that user's drawings and other readable files and modification of their writable files.
The supplied chunk implements a release-time sanitization utility, not CAD/PDF parsing or recognition-candidate generation. Although release hygiene can support a larger project, this script exposes a standalone scanning and file-rewriting capability that is not described in the declared purpose. Its optional redaction operates directly on source files, making the difference substantive rather than merely an internal implementation detail. No network transmission or final engineering-quantity calculation is shown.
Contract validation, hashing, confidence metadata, and final_quantity=false are consistent with the declared purpose. However, this chunk's primary function is cross-skill state synchronization rather than parsing or ordinary parser caching. The description does not disclose the shared bus integration, external client execution, or shared-state updates. No direct network access or final-quantity calculation is shown; the mismatch concerns the additional integration and persistence capabilities, not the absence of parsing in this helper.
Referenced artifact was not completely inspected
- 依赖自检：`bash scripts/deps_check.sh --minimal`；缺 numpy 只影响梁线几何估算，其余功能降级为 review。
Referenced artifact was not completely inspected
- 30 秒样例：`bash scripts/demo.sh`；完整包用内置 `examples/sample_room.dxf`，SkillHub 轻量包若含 `.dxf` 则由 `scripts/generate_sample.py` 现场重建同一样例（跑识图→测量→契约校验）。
Referenced artifact was not completely inspected
平台安装与 FAQ 见 `README.md`“平台支持矩阵”。
Referenced artifact was not completely inspected
- `--state-push` / `--resume` 分别为 push / pull 的别名；Windows 统一用 `python scripts/cad_statesync.py push/pull ...`（Windows SkillHub 版无 `.cmd`，直接走 py 入口，功能等价）。
Referenced artifact was not completely inspected
- Windows 接线：Windows SkillHub 版无 `.cmd`，统一用 `python scripts/cad_statesync.py push/pull ...`（功能一致）。Windows 未实机跑通，仅静态校验通过（CRLF 行尾；无 /Users、/bin/sh、python3 硬编码；py
Referenced artifact was not completely inspected
发布前仍跑 `scripts/run_preflight.sh`：依次执行全量 self-test、契约样例校验、`cad_release_scrub.py` 脱敏扫描；带真图清单时加 `--manifest <本地真图清单.json>` 跑真实图纸回归。任一环节失败即视为未通过，禁止发布（本机自测现 205 项）。
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
cmd += [str(path), "--format", "json", "--detail-json", str(detail_path), "--budget", str(budget)]
if cache_dir:
cmd += ["--cache-dir", str(cache_dir)]
env = dict(os.environ)
env.setdefault("CAD_CONCISE", "1")
timeout = budget if budget and budget > 0 else None
try:
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
tmp = Path(tmpd)
detail = tmp / "sample_detail.json"
out_prefix = tmp / "sample_out"
env = dict(os.environ)
env.setdefault("PYTHONPATH", str(SKILL_DIR / "vendor"))
env["CAD_CONCISE"] = "0"
proc = subprocess.run(
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
"ok = all(u.find_spec(m) is not None for m in mods)\n"
"print('import_ok=' + str(ok))\n"
)
env = dict(os.environ)
env["PYTHONPATH"] = str(dest) + os.pathsep + env.get("PYTHONPATH", "")
env["PYTHONUTF8"] = "1"
proc = subprocess.run([interpreter, "-c", code], env=env, capture_output=True, text=True, timeout=120)
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
cmd = [python, str(SETUP_PY)]
if "--dry-run" in sys.argv:
cmd.append("--dry-run")
env = dict(os.environ)
env["PYTHONUTF8"] = "1"
r = subprocess.run(cmd, env=env)
if r.returncode != 0:
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
rules = json.load(fh)
rules_dir = path.parent / "rules"
if not rules_dir.is_dir():
return rules
for jf in sorted(rules_dir.glob("*.json")):
try:
with jf.open("r", encoding="utf-8") as fh:
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
rules[key] = merged
else:
rules[key] = val
return rules
def pattern_hit(value: str, pattern: Any) -> bool:
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
rules: list[dict[str, Any]] = []
errors: list[str] = []
if not rules_dir.is_dir():
return rules, [f"规则目录不存在：{rules_dir}"]
for path in sorted(rules_dir.rglob("*.json")):
if path.name.startswith("_"):
continue
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
rules.append(item)
except Exception as exc:
errors.append(f"{path.name}: {exc}")
return rules, errors
_SAFE_FUNCS = {
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
def load_rules_with_institute(rules, institute=None):
if not institute:
return rules
rp = INSTITUTE_DIR / f"{institute}.json"
if not rp.exists():
raise FileNotFoundError(f"设计院图例覆盖不存在：{rp}")
os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.
for c in cands:
if os.path.isfile(c) and os.path.realpath(c) != cur:
os.environ["CAD_SCAN_REEXEC"] = "1"
os.execv(c, [c] + sys.argv)
ensure_runtime()
Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
# 用法: python3 generate_sample.py <输出路径>
import base64, pathlib, sys
DATA = 'ICAwClNFQ1RJT04KICAyCkhFQURFUgogIDkKJEFDQURWRVIKICAxCkFDMTAxNQogIDkKJEFDQURNQUlOVFZFUgogNzAKNgogIDkKJERXR0NPREVQQUdFCiAgMwpBTlNJXzEyNTIKICA5CiRJTlNCQVNFCiAxMAowLjAKIDIwCjAuMAogMzAKMC4wCiAgOQokRVhUTUlOCiAxMAoxZSsyMAogMjAKMWUrMjAKIDMwCjFlKzIwCiAgOQokRVhUTUFYCiAxMAotMWUrMjAKIDIwCi0xZSsyMAogMzAKLTFlKzIwCiAgOQokTElNTUlOCiAxMAowLjAKIDIwCjAuMAogIDkKJExJTU1BWAogMTAKNDIwLjAKIDIwCjI5Ny4wCiAgOQokT1JUSE9NT0RFCiA3MAowCiAgOQokUkVHRU5NT0RFCiA3MAoxCiAgOQokRklMTE1PREUKIDcwCjEKICA5CiRRVEVYVE1PREUKIDcwCjAKICA5CiRNSVJSVEVYVAogNzAKMQogIDkKJExUU0NBTEUKIDQwCjEuMAogIDkKJEFUVE1PREUKIDcwCjEKICA5CiRURVhUU0laRQogNDAKMi41CiAgOQokVFJBQ0VXSUQKIDQwCjEuMAogIDkKJFRFWFRTVFlMRQogIDcKU3RhbmRhcmQKICA5CiRDTEFZRVIKICA4CjAKICA5CiRDRUxUWVBFCiAgNgpCeUxheWVyCiAgOQokQ0VDT0xPUgogNjIKMjU2CiAgOQokQ0VMVFNDQUxFCiA0MAoxLjAKICA5CiRESVNQU0lMSAogNzAKMAogIDkKJERJTVNDQUxFCiA0MAoxLjAKICA5CiRESU1BU1oKIDQwCjIuNQogIDkKJERJTUVYTwogNDAKMC42MjUKICA5CiRESU1ETEkKIDQwCjMuNzU
os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.
if not args or args[0] not in ("--list", "-h", "--help"):
better = _prefer_runtime_python()
if better:
os.execv(better, [better, str(Path(__file__).resolve())] + args)
if not args:
_print_usage()
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
elif not args.quiet:
print("vendor 已由 GitHub Release 完整包补齐。")
env_file = SKILL_DIR / ".env"
if not env_file.exists() or "PYTHONPATH=" not in env_file.read_text(encoding="utf-8", errors="ignore"):
env_file.write_text(
f"# 由 scripts/setup.py 生成；供未走 run_cad 自举的手工调用使用\n"
Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
def test_rejects_arbitrary_code(self):
hostile = [
"__import__('os').system('echo hi')",
"().__class__.__base__.__subclasses__()",
"open('/etc/passwd').read()",
"[x for x in range(3)]",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
hostile = [
"__import__('os').system('echo hi')",
"().__class__.__base__.__subclasses__()",
"open('/etc/passwd').read()",
"[x for x in range(3)]",
"sys.exc_info()",
"namespace.get('_SAFE_FUNCS')",
Without declared permissions the skill's intent is opaque and cannot be validated.
L080 specifies that review_notes retain Chinese explanations, imposing a natural-language constraint on user-facing output. Although the manifest lists both zh-CN and en-US, the instruction provides no user language choice or documented justification for requiring Chinese in this field.
No suspicious patterns detected.