Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marks this skill suspicious because it found a contract-integrity weakness that could let altered steel quantities qualify for formal downstream use, alongside a mismatch between its stated limits and reported capabilities.
Consider avoiding installation until the contract-hash weakness and the mismatch between stated limits and reported drawing and quantity-estimation capabilities are resolved. The verdict is suspicious, not malicious; some scanner coverage is incomplete, so these results do not establish that the skill is safe.
The commands invoke cad_scan.sh with text, insert, geometry, and geometry-layer extraction options, followed by cad_steel_geometry.sh. Although recognition is delegated to cad-file-reader, it remains an explicit part of this workflow and contradicts the declared exclusion. Contract synchronization and validation support the declared tonnage-estimation purpose and are not separate mismatches.
吨位计算、契约校验和结果导出均与声明用途一致，状态同步也属于支持性实现细节。但所示流程在没有可复用契约时，会明确调用 cad_scan.sh 和 cad_steel_geometry.sh 执行图纸识别及几何提取。虽然识别由另一个技能完成，而非吨位计算脚本自行实现，所提供的整体工作流仍包含该能力，因此“不识图”的声明未准确反映实际行为。没有证据表明其替代结算。
Tonnage estimation, contract validation, state synchronization, and output generation support the declared purpose. However, the supplied workflow explicitly invokes cad_scan.sh and cad_steel_geometry.sh to interpret a steel drawing when no reusable contract exists. Delegating that work to cad-file-reader does not remove it from the supplied workflow's behavior, so the unqualified '不识图' limitation is inaccurate. Nothing shown indicates that the workflow replaces final settlement calculations.
The primary tonnage calculation matches the description: the supplied script does not parse drawings itself and explicitly marks results final_quantity=false. However, connection_ledger and finish_ledger provide additional quantity-estimation outputs beyond tonnage, especially coating areas, which are not disclosed by the narrow description. Contract retrieval, dependency checks, validation, and report generation are supporting implementation details rather than mismatches. No unrelated data exfiltration or automatic dependency installation is evident in the supplied chunk; imported helper implementations were not supplied.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def clean_env(extra=None):
env = os.environ.copy()
for key in ("CAD_FILE_READER_HOME", "CAD_SKILL_DIR", "SKILLBUS_HOME",
"CAD_DEV_DXF", "CAD_ALLOW_DIRECT"):
env.pop(key, None)
Without declared permissions the skill's intent is opaque and cannot be validated.
Suspicious Unicode normalization or mixed-script content
Suspicious Unicode normalization or mixed-script content
Even with require_hash=True, a missing contract hash produces only a warning, while self-declared reader/bus provenance and a nonempty contract ID can still yield formal-ledger eligibility. An input supplier can remove a mismatching hash to bypass this integrity check, potentially laundering altered steel quantities into trusted downstream outputs; separate bus authentication may limit end-to-end exploitability but is not established by this source.
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
os.environ.get("CAD_SKILL_DIR"),
Path.home() / ".codex" / "skills" / "cad-file-reader",
Path.home() / ".claude" / "skills" / "cad-file-reader",
*sorted(Path.home().glob(".workbuddy/skills/*/cad-file-reader")),
])
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
out.append(Path(raw).expanduser())
out.extend(root / slug for root in _default_roots())
if slug == "cad-file-reader":
out.extend(sorted(Path.home().glob(".workbuddy/skills/*/cad-file-reader")))
return out
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
manifest = root / "manifest.json"
if manifest.is_file():
try:
data = __import__("json").loads(manifest.read_text(encoding="utf-8"))
version = data.get("version")
if isinstance(version, str) and version.strip():
return version.strip()
Suspicious Unicode normalization or mixed-script content
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd = [sys.executable, str(client), "pull", "--project", project,
"--entry-id", contract_id]
try:
proc = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
except (OSError, subprocess.TimeoutExpired) as exc:
return None, "bus pull 执行失败：%s" % exc
if proc.returncode != 0:
Suspicious Unicode normalization or mixed-script content
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
},
"source": {
"file": "synthetic-s2.dwg",
"sha256": "3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f"
},
"contract": {
"schema": "cad-steel-geometry/v1",
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_skill(slug: str, entry: str, args, env):
return subprocess.run(
[sys.executable, str(SKILLS / slug / "scripts" / entry)] + [str(a) for a in args],
capture_output=True, text=True, env=env, cwd=str(SKILLS / slug))
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
script = SKILLS / "gangjiegou-suanliang" / "scripts" / "steel_tonnage.py"
def run_steel(args):
return subprocess.run([sys.executable, str(script)] + [str(a) for a in args],
capture_output=True, text=True, env=env_bus)
p2 = tmp / "t2"
The changelog explicitly states that rejected DWG/DXF/DWT inputs produce a fixed Chinese message. This mandates a specific output language without documenting user opt-in or a justified locale restriction.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
os.environ.setdefault("PYTHONIOENCODING", "utf-8")
os.environ.setdefault("PYTHONUTF8", "1")
for _name in ("stdout", "stderr"):
_stream = getattr(sys, _name, None)
_reconf = getattr(_stream, "reconfigure", None)
if callable(_reconf):
try: