Mechanics Sketches

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:57 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent local engineering-sketch helper, but its install and import path choices create review-worthy supply-chain and local code-hijacking risk.

Install only in an isolated virtual environment without administrator privileges, prefer a pinned commit or reviewed release of MechanicsSketches, and avoid running the helper from shared or world-writable directory layouts until the import-path behavior is fixed.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/generate_sketch.py:17
• Finding: Python Import Path Precedence Enables Local Package Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_sketch.py`, lines 17–20 **Vulnerability Type**: Python module search-path hijacking **Risk Level**: High ### Vulnerable Code ```python # Ensure MechanicsSketches is importable sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "..")) from MechanicsSketches import * # noqa: E402 from MechanicsSketches.qt_renderer import render # noqa: E402 ``` ### Technical Analysis The script inserts a three-level ancestor of its own directory at index zero of `sys.path`. In the audited directory layout, this resolves to `/tmp`, which commonly permits unprivileged users to create files and directories. Because this path takes precedence over installed packages, Python may import a locally planted `MechanicsSketches` package instead of the legitimate dependency. Importing a Python package executes its initialization code, so a malicious `MechanicsSketches/__init__.py` or `MechanicsSketches/qt_renderer.py` can execute arbitrary Python code before the helper processes the input sketch. Exploitation requires an attacker to be able to create the spoofed package in the inserted ancestor directory before a victim runs the script. The issue is especially significant in shared temporary directories or automated environments where multiple users or jobs operate under different trust boundaries. ### Attack Path 1. An attacker determines that the helper script inserts `/tmp` or another attacker-writable ancestor at the beginning of `sys.path`. 2. The attacker creates a spoofed package, such as: - `/tmp/MechanicsSketches/__init__.py` - `/tmp/MechanicsSketches/qt_renderer.py` 3. The package files contain attacker-controlled Python code and optionally expose enough expected names to avoid an immediate import failure. 4. A victim invokes the documented command: ```bash python scripts/generate_sketch.py input.json output.pdf ``` 5. Python resolves `MechanicsSketches` from the att ...[truncated 719 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the search-path modification and import the installed dependency normally: ```python from MechanicsSketches import ( create_sketch, add_beam, add_truss, add_pinned_support, add_roller_support, add_fixed_support, add_hinge, add_force, add_moment, add_dimension_arrow, add_dimension_thickness, add_coordinate_system, add_text, ) from MechanicsSketches.qt_renderer import render ``` 2. Install the dependency into an isolated virtual environment rather than manipulating `sys.path`. 3. If source-tree imports are required for development, calculate the exact expected repository directory and validate it before use. At minimum: - Resolve the path with `pathlib.Path.resolve()`. - Confirm that it is inside the trusted project root. - Reject world-writable or group-writable directories. - Never add a shared temporary directory to the front of `sys.path`. 4. Replace the wildcard import with explicit imports. This limits namespace manipulation and makes the expected dependency interface auditable. 5. Run the helper with least privilege and use isolated temporary directories with restrictive permissions in shared or automated environments. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23
• Finding: Unpinned Git Dependency Allows Mutable Upstream Code Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 23 **Vulnerability Type**: Unpinned third-party VCS dependency **Risk Level**: Medium ### Vulnerable Code ```bash pip install git+https://github.com/MatthiasHBusch/MechanicsSketches.git ``` ### Technical Analysis The installation command retrieves MechanicsSketches from the mutable default branch of a remote Git repository. It does not identify a reviewed release, immutable commit, or integrity digest. Consequently, the code installed by this command can change after the skill has been audited. A compromise of the upstream repository, maintainer account, release process, or dependency chain could cause users to retrieve different and potentially malicious code while following unchanged skill instructions. Python package installation may execute build-backend or packaging logic, and the installed package is later imported and executed by `scripts/generate_sketch.py`. The risk therefore applies both during installation and at runtime. The repository URL is consistent with the homepage declared by the skill, and the audited files contain no evidence that the current upstream project is malicious. The vulnerability is the absence of immutable version and integrity controls. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or another mechanism capable of modifying its default branch. 2. The attacker adds malicious packaging, initialization, renderer, or transitive dependency behavior. 3. A user follows the setup instructions and runs: ```bash pip install git+https://github.com/MatthiasHBusch/MechanicsSketches.git ``` 4. Pip downloads the current, attacker-modified repository state rather than a previously reviewed revision. 5. Malicious code may execute during package build or installation. 6. If it does not execute during installation, it can execute later when the helper imports `MechanicsSketches` and its renderer. ### Impact Assessmen ...[truncated 538 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a reviewed immutable commit: ```bash pip install "git+https://github.com/MatthiasHBusch/MechanicsSketches.git@<full-reviewed-commit-hash>" ``` 2. Prefer a trusted package registry release with an exact version rather than installing directly from a mutable Git branch. 3. Maintain a lock file containing exact versions and cryptographic hashes for the dependency and its transitive dependencies. Use hash-enforced installation where supported. 4. Review and update pinned revisions through a controlled dependency-update process. Each update should include source review, automated security scanning, and rendering tests. 5. Install dependencies inside a dedicated virtual environment without administrative privileges. 6. Correct the security documentation in `SKILL.md`. The statement that the skill makes no network requests should distinguish runtime rendering from setup, because the documented installation command performs a network fetch and introduces supply-chain exposure. ]]>

SkillSpector

Vulnerability Patterns

• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

• Category: YARA Match

Content

gineering figures.
license: MIT
homepage: https://github.com/MatthiasHBusch/MechanicsSketches
metadata: {"author": "MatthiasHBusch", "version": "1.0.0"}
files: ["scripts/*", "references/*"]
---

# MechanicsSketches Skill

You can generate engineering mechanics sketches programmatically using the **MechanicsSketches** Python library.

## Setup

Install the library via pip:

```bash
pip install git+https://github.com/MatthiasHBusch/MechanicsSketches.git
```

Or install dependencies manually and add to `PYTHONPATH`:

```bash
pip install matplotlib PyQt5
export PYTHONPATH="/path/to/parent/of/MechanicsSketches:$PYTHONPATH"
```

## Quick Start — Writing a Script

Create a Python script that builds a sketch and renders it:

```python
from MechanicsSketches import *
import os

sketch = create_sketch("My Sketch")
S = 30.0  # Scale factor (recommended: 20-40)

# Add components
add_beam(sketch, ax=0, ay=0, bx=10*S, by=0, scale_factor=S)
add_pinned_support(

• Confidence: 95% confidence
• Finding: The setup instructions tell users to install code directly from a remote GitHub repository using `pip install git+https://...`, which executes arbitrary package build/install logic from a moving remote source. This creates a supply-chain risk: if the repository, dependency chain, or referenced revision is compromised, users may run attacker-controlled code during installation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Static analysis

No suspicious patterns detected.