Security audit

CAD Viewer

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real local CAD viewer, but it also exposes under-disclosed code-execution and file-writing behavior that should be reviewed before installation.

Install only if you trust the CAD files and generators you will open. Treat `.implicit.js`, `.implicit.mjs`, STEP sidecar modules, and Python CAD generator files as executable code, not passive models. Use a narrow, dedicated model directory as `--dir`, avoid opening untrusted review links with custom query parameters, and expect the viewer to keep a local server running and to create export/artifact files inside that directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs the agent to invoke shell commands, access local files, and interact with a local network service, but it does not declare any permissions for those capabilities. That mismatch is dangerous because it hides the actual execution and data-access surface from any permission review layer, making unintended file exposure, local service interaction, or command execution easier to approve without adequate scrutiny.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The backend exposes functionality that can invoke platform file explorers/open commands on the host (`open`, `explorer.exe`, `xdg-open`) for paths derived from requests. In an agent setting, this creates an unintended host-interaction primitive that can be triggered remotely, causing local application launches and revealing filesystem structure or disrupting the operator environment.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill description says it starts/reuses a viewer and returns review links, but the backend also generates STEP artifacts and implicit CAD exports, which writes or overwrites local files. That mismatch is dangerous because callers may treat the skill as read-only while it performs side effects on the filesystem and invokes generation workflows.

Context-Inappropriate Capability

High

Confidence: 92% confidence
Finding: The backend spawns external Python tooling (`python -m cadpy.step_artifact`) based on request-driven file selection. Even without shell interpolation, this creates a code-execution bridge into another toolchain with its own parsing and side effects, increasing the risk of arbitrary file writes, resource exhaustion, or exploitation of the Python CAD pipeline from a network-reachable endpoint.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The bundle performs outbound GitHub release checks and opens external GitHub URLs, which is unrelated to the stated local CAD-viewing purpose and introduces unexpected network egress. In a viewer handling potentially sensitive local CAD paths and metadata, unsolicited external connectivity can leak usage patterns, environment details, and create supply-chain/privacy risk if the endpoint or returned data is abused.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The viewer includes client-side functionality to export implicit CAD models to STL/GLB/3MF via a server endpoint, which exceeds the declared viewing-only behavior of the skill. This expands the attack surface from passive rendering to server-side transformation/exfiltration workflows and could enable unauthorized conversion or download of sensitive models if access controls are weak.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The renderer can fetch an environment texture from a URL derived from a preset, which introduces network behavior into a skill described as local CAD viewing/review. Even if the preset list is internal, this creates unexpected outbound requests that can leak usage metadata, create tracking opportunities, or expand the trust boundary beyond local file rendering.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Using THREE.TextureLoader.loadAsync on a URL gives the rendering path network-capable behavior that is not obviously necessary for generating CAD review images. In a viewer context, this can be abused to trigger unexpected outbound connections, expose client IP/request metadata, or weaken assumptions that opening local design files is an offline action.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: `loadStepModuleDefinition` performs a dynamic `import()` on a caller-supplied URL, which executes the imported module's top-level JavaScript before normalization occurs. In a CAD viewer context, this means opening or previewing an untrusted `.step.js` runtime module can run arbitrary code in the viewer's origin, enabling XSS-like behavior, data exfiltration, or abuse of authenticated viewer capabilities rather than merely parsing CAD metadata.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: This file implements persistent WebSocket communication to a MoveIt2 backend and exposes a generic request API, which expands the viewer from passive CAD review into active backend interaction. In the context of a skill intended only to start/reuse a CAD viewer and return review links, this creates unnecessary attack surface and could enable unintended interaction with local robot-planning infrastructure if reachable.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The code allows the WebSocket endpoint to be overridden via the moveit2Ws URL query parameter, letting anyone who can influence the review link redirect the browser to an arbitrary WebSocket service. In a CAD-viewing workflow, this is especially risky because opening a review link could silently cause the user's browser to probe or interact with internal or local services, including robot-related backends, creating SSRF-like browser pivoting and unintended command surfaces.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The loader imports and executes the target assembly Python file via importlib and then calls its gen_step() function, which means opening an untrusted assembly spec can run arbitrary local code with the current process privileges. In a CAD viewer context this is especially risky because users may expect passive parsing/rendering, not code execution, so a crafted assembly file can trigger filesystem access, subprocess execution, or data exfiltration during review.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The code temporarily rewrites sys.path, injects a synthetic module into sys.modules, and executes arbitrary local modules resolved from repository-relative search paths. This expands the attack surface beyond a single assembly file by enabling import-time side effects from neighboring packages, creating confusion and unintended code execution paths during a viewer operation.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: _resolve_configured_artifact_path validates that configured artifact paths are relative and use POSIX separators, but it does not reject '..' path segments. As a result, a crafted value like '../secret/file.glb' resolves outside the CAD file's directory and potentially outside the repository, letting the viewer catalog reference arbitrary filesystem files. In a file-review skill, that expands trusted CAD inputs into general local file access, which is riskier because downstream components may expose or process those files.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This module materially exceeds the declared viewer skill scope: it generates CAD, executes generators, meshes scenes, and writes multiple artifacts to disk rather than only starting/reusing a viewer and returning links. Scope mismatch is dangerous because callers may invoke a supposedly low-risk viewer capability while actually triggering code execution and filesystem modification.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code dynamically loads and executes local Python CAD generator scripts via importlib and exec_module, after modifying sys.path to include several repository-controlled directories. In a viewer context this is especially risky: a user expecting passive visualization could instead trigger arbitrary Python execution from a crafted or compromised generator file.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The module writes STEP/GLB/STL/3MF/DXF-related artifacts and can overwrite outputs on disk, which is inconsistent with a viewer-adjacent capability. Even if intended for normal CAD workflows, this increases risk of unintended file modification, artifact clobbering, and abuse through path-controlled output locations.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The function dynamically imports a local JavaScript module from a path supplied at runtime, which executes top-level code in that file. In a viewer/export workflow, this means a crafted `.implicit.js` or `.implicit.mjs` file can trigger arbitrary code execution on the host running the skill, far exceeding the stated purpose of visually reviewing CAD artifacts.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The loader performs a dynamic import on a caller-controlled URL, which causes JavaScript module code to execute immediately on load. In a CAD viewer context, treating model inputs as executable modules rather than passive data creates a code-execution boundary crossing: a crafted implicit CAD file or URL can run arbitrary script in the viewer environment, access ambient browser capabilities, and potentially exfiltrate data or manipulate the application.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: This code converts arbitrary source text into a data:text/javascript URL and imports it, directly executing attacker-supplied code. Because the source is inline and bypasses network-origin checks, any untrusted model text handed to this loader becomes active script execution, which is especially dangerous in a viewer expected to handle user-provided artifacts.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This code path writes files to disk through the local asset backend, but the skill context presents the tool as a viewer/review helper rather than a mutating tool. Hidden writes in a review-oriented skill are risky because users and orchestrators may authorize it in contexts where filesystem mutation is unexpected or prohibited.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: This file shows external texture fetching but no visible disclosure, logging, or consent mechanism around that behavior. The main risk is transparency and privacy: users may reasonably expect a CAD viewer to operate locally, while this code silently performs network requests for appearance features.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The same caller-controlled dynamic import executes code with no visible warning or consent mechanism in this file, so a user or upstream agent may reasonably assume the viewer is only loading CAD data when it is actually running JavaScript. That mismatch increases the chance that untrusted design artifacts are treated as safe review inputs, making code execution more likely in practice.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This file provides no user-facing indication that reading an assembly spec will execute Python code, which creates a dangerous trust mismatch for a CAD review feature. Users or calling systems may pass files for visualization assuming they are inert, allowing an attacker to hide code execution behind normal review workflows.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: At the execution point, the code runs a dynamically loaded generator with no clear non-verbose disclosure that arbitrary Python from the target script is about to execute. In this skill context, lack of disclosure increases the chance that operators treat the action as a safe viewer operation and unknowingly run untrusted code.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/viewer/backend/server.mjs:22971

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/viewer/packages/cadjs/scripts/run-tests.mjs:30

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/viewer/packages/implicitjs/scripts/run-tests.mjs:33

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/viewer/packages/cadpy/src/cadpy/assembly_spec.py:243

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/viewer/packages/cadpy/src/cadpy/generation.py:738