DXF

• Outcome: Review
• Latest audit: Jul 10, 2026 · 12:08 AM UTC
• Version: 1.0.0

Overview

This DXF skill is coherent and purpose-aligned, but users should treat its Python generator targets as executable code.

Install this only if you expect a code-running CAD/DXF generator. Review or create the gen_dxf()/gen_step() Python files yourself, avoid running generator files from untrusted repositories, check output paths before generation, and consider pinning ezdxf or using a sandbox for unfamiliar designs.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructions direct the agent to read and write workspace files and invoke Python-based tooling, but the skill declares no permissions. That mismatch can bypass operator expectations and policy controls, making file and environment access occur without explicit review; in a code-executing skill, hidden capabilities materially expand attack surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence
• Finding: The metadata presents the skill as limited to 2D DXF generation, but the body instructs use of broader CAD workflows, including generating STEP-derived artifacts, invoking other skills, and inspecting existing files. A description-behavior gap is dangerous because reviewers and users may grant trust or permissions based on the narrow description while the effective workflow can access more data, produce more artifact types, and trigger additional toolchains than expected.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The loader imports a Python file from disk, executes its top-level code via exec_module(), and then calls gen_step(), so any assembly spec file can run arbitrary code with the process's privileges. In this skill context, that behavior exceeds simple DXF/assembly parsing and turns untrusted project content into executable code, enabling filesystem access, network activity, or further code execution if a malicious assembly source is opened.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code dynamically constructs a module spec from a file path, mutates sys.path to add repository-relative search locations, registers the module in sys.modules, and executes it. This expands the attack surface beyond the target file itself by allowing import resolution from added paths, making dependency hijacking or malicious local-module imports more feasible when processing attacker-controlled repositories.

Description-Behavior Mismatch

High

• Confidence: 87% confidence
• Finding: This file backs a DXF-oriented skill but also exposes broad CAD generation capabilities including STEP, GLB/topology, STL, 3MF, and assembly artifact production. In an agent-skill context, that expands the effective capability surface beyond the declared DXF scope, increasing the chance of unintended code paths, side effects, and abuse when the skill is invoked under a narrower trust assumption.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The module dynamically loads Python files from disk with importlib.util.spec_from_file_location(), alters sys.path, executes them via exec_module(), and later calls exported generator functions. In a skill environment, any user-selected or repository-provided generator script becomes arbitrary code execution with the privileges of the agent process, enabling file access, network calls, secret theft, and system modification.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This file provides no user-facing indication that reading an assembly spec will execute arbitrary Python, which creates a dangerous trust mismatch: users may expect parsing but instead trigger code execution. Lack of disclosure does not create the core code-execution bug, but it materially increases the chance of accidental exploitation by causing users and integrators to treat untrusted files as safe inputs.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: After loading the module, the code immediately resolves and invokes the generator function without any confirmation or prominent warning that arbitrary Python will execute. For a DXF skill, users may reasonably expect document conversion rather than code execution, so the absence of warning materially increases the risk of accidental execution of untrusted repository scripts.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

--editable ./scripts/packages/cadpy
ezdxf

• Confidence: 89% confidence
• Finding: The dependency `ezdxf` is unpinned, so installs may resolve to different versions over time, including versions with newly introduced bugs, breaking changes, or known vulnerabilities. In a build or agent skill environment, this weakens reproducibility and increases supply-chain risk because the executed code can change without review.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/packages/cadpy/src/cadpy/assembly_spec.py:243

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/packages/cadpy/src/cadpy/generation.py:738