Security audit

CAD

Security checks across malware telemetry and agentic risk

Overview

This CAD skill appears legitimate, but it should be reviewed because Python CAD files it processes can run unrestricted local code.

Install only if you are comfortable with a CAD skill that runs Python generator files as local code. Use it on CAD files you authored or trust, avoid running generator files from unknown repositories, and prefer isolated workspaces for third-party CAD projects.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs the agent to use local Python scripts, read and write workspace files, and reference a remote repository for provenance, which implies effective file, environment, and possible network capabilities. However, the skill declares no permissions or trust boundaries, creating a mismatch that can lead to over-privileged execution, accidental data exposure, or unsafe file operations without explicit user awareness or enforcement.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The parser path is not just reading data: `_run_assembly_generator()` imports the target assembly file with `exec_module()` and then invokes `gen_step()`, which executes arbitrary Python from the assembly file during what appears to be spec inspection/parsing. In a CAD skill that may process user-supplied or repository-provided assembly definitions, this creates a code-execution boundary where opening or validating an assembly can run attacker-controlled code with the current process privileges.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The code dynamically imports a Python file from a target path, mutates sys.path to broaden import resolution, and then executes the module and its generator function. Any untrusted or attacker-supplied CAD generator script therefore gets full Python code execution with the privileges of the invoking process, which is especially dangerous in a skill explicitly designed to process external CAD sources and generator files.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code dynamically loads arbitrary modules from disk and executes them without any explicit warning, consent, or trust check, so a caller expecting passive validation may unknowingly trigger code execution. The risk is amplified because the loader modifies `sys.path` to include multiple parent directories, increasing the attack surface for unintended imports during module execution.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The tool executes generator modules automatically once selected, but there is no prominent user-facing confirmation or warning that arbitrary Python code will run. In this CAD skill context, users may reasonably expect 'generate CAD from script' to process geometry, not to execute unrestricted host-side code, increasing the risk of accidental execution of malicious repository content.

Unpinned Dependencies

Low

Category: Supply Chain
Content: --editable ./scripts/packages/cadpy playwright
Confidence: 90% confidence
Finding: playwright

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/packages/cadpy/src/cadpy/assembly_spec.py:243

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/packages/cadpy/src/cadpy/generation.py:738