T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:372- Finding
Persistent Project-Controlled Agent Memory Is Automatically Trusted
- Content
View full analysis
- Remediation
View remediation
Security audit
CAD Viewer
Security checks for vulnerabilities and agentic risk
Overview
This CAD analysis skill appears legitimate in purpose, but it needs review because setup can make privileged system changes from unverified downloads and the skill tells agents to trust persistent project learning files.
Install only if you are comfortable with an agent skill that can run a setup script using sudo and network downloads. Prefer manual, verified installation of ODA/QCAD and Python dependencies, avoid running setup as root unless necessary, and disable or ignore the .learning mechanism unless you intentionally want project-local memory that future agent sessions will read.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/setup.sh:66- Finding
Local Package Arguments Bypass Explicit Setup Confirmation
- Content
View full analysis
/dev/null; then log_ok "$pkg already installed" else log_info "Installing $pkg ..." pip3 install "$pkg" -q && log_ok "$pkg installed successfully" || log_err "$pkg installation failed" fi } install_python_pkg ezdxf install_python_pkg matplotlib ``` ```bash if command -v xvfb-run &>/dev/null; then log_ok "xvfb-run already installed" else log_info "Installing xvfb ..." if [ "$PKG_MANAGER" = "apt-get" ]; then sudo apt-get update -qq && sudo apt-get install -y -qq xvfb else sudo $PKG_MANAGER install -y xorg-x11-server-Xvfb 2>/dev/null || \ sudo $PKG_MANAGER install -y Xvfb 2>/dev/null || \ sudo $PKG_MANAGER install -y xvfb 2>/dev/null || \ log_warn "xvfb installation failed, ODA and QCAD graphics rendering may be unavailable" fi fi ``` ```bash if [ "$QCAD_INSTALLED" = true ]; then log_info "Checking QCAD system dependencies..." if [ "$PKG_MANAGER" = "apt-get" ]; then sudo apt-get ...[truncated 1827 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
scripts/setup.sh:164- Finding
Downloaded ODA and QCAD Components Are Installed Without Integrity Verification
- Content
View full analysis
/dev/null || \ curl -sL --connect-timeout 30 -o "$TMP_DIR/$FILENAME" "$url" 2>/dev/null; then if [ -s "$TMP_DIR/$FILENAME" ]; then EXT="${FILENAME##*.}" if [ "$EXT" = "rpm" ]; then sudo rpm -i --replacefiles --nodeps "$TMP_DIR/$FILENAME" 2>/dev/null && ODA_DOWNLOADED=true elif [ "$EXT" = "deb" ]; then sudo dpkg -i "$TMP_DIR/$FILENAME" 2>/dev/null && ODA_DOWNLOADED=true fi if [ "$ODA_DOWNLOADED" = true ]; then log_ok "ODA File Converter installed successfully" break fi fi fi done ``` ```bash # Auto-download QCAD Trial (includes dwg2bmp) log_info "Attempting to automatically download QCAD Professional Trial..." QCAD_URLS=( "https://www.qcad.org/archives/qcad/qcad-3.32.6-trial-linux-x86_64.tar.gz" "https://www.qcad.org/archives/qcad/qcad-3.32.5-trial-linux-x86_64.tar.gz" "https://www.qcad.org/archives/qcad/qcad-3.32.4-trial-linux-x86_64.tar.gz" ) TMP_DIR=$(mktemp -d) QCAD_DOWNLOADED=false for url in "${QCAD_URLS[@]}"; do FILENAME=$(base ...[truncated 2597 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/setup.sh:108- Finding
Unpinned Python Dependencies Are Installed from the Active Package Index
- Content
View full analysis
/dev/null; then log_ok "$pkg already installed" else log_info "Installing $pkg ..." pip3 install "$pkg" -q && log_ok "$pkg installed successfully" || log_err "$pkg installation failed" fi } install_python_pkg ezdxf install_python_pkg matplotlib ``` ### Technical Analysis The setup process installs `ezdxf` and `matplotlib` without version constraints or cryptographic hashes. The selected packages therefore depend on the active `pip` configuration, configured index URLs, and newest compatible releases available when setup runs. Although the package names are legitimate and no dependency-confusion package is directly identified in the audited files, the installation process lacks reproducibility and supply-chain integrity controls. Python packages and their transitive dependencies may execute build or installation code, and their imported runtime code executes with the privileges of the invoking user. ### Attack Path 1. An attacker compromises a configured package index, a package release, a transitive dependency, or the user's `pip` index configuration. 2. The user runs the assisted setup process. 3. `pip3 install` resolves an attacker-controlled or compromised release because no version or hash is pinned. 4. Malicious installation hooks, build logic, or imported package code executes. 5. The attacker gains code execution with the privileges of the user running setup. ### Impact Assessment Successful exploitation grants code execution under the setup user's account. If setup is launched from a privileged shell, the impact may be elevated accordingly. The malicious package can access files, credentials, environment variables, and network resources available to that ...[truncated 110 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.sh:241- Finding
QCAD Archives Are Extracted Without Validating Archive Entries
- Content
View full analysis
/dev/null ``` ```bash TMP_DIR=$(mktemp -d) QCAD_DOWNLOADED=false for url in "${QCAD_URLS[@]}"; do FILENAME=$(basename "$url") log_info "Attempting download: $FILENAME" if wget -q --timeout=60 -O "$TMP_DIR/$FILENAME" "$url" 2>/dev/null || \ curl -sL --connect-timeout 60 -o "$TMP_DIR/$FILENAME" "$url" 2>/dev/null; then if [ -s "$TMP_DIR/$FILENAME" ]; then mkdir -p "$QCAD_INSTALL_DIR" tar -xzf "$TMP_DIR/$FILENAME" -C "$QCAD_INSTALL_DIR" --strip-components=1 2>/dev/null if [ -f "$QCAD_INSTALL_DIR/dwg2bmp" ]; then QCAD_DOWNLOADED=true log_ok "QCAD extracted successfully" break fi fi fi done ``` ### Technical Analysis Both local and remotely downloaded archives are passed directly to `tar` without first inspecting their member paths or types. The script does not reject absolute paths, parent-directory traversal, symbolic links, hard links, device files, unexpected ownership metadata, or files outside an expected manifest. The extraction occurs directly into the persistent Skill assets directory rather than a disposable staging directory. Security consequences depend on the `tar` implementation and archive construction, but unsafe archive entries and link chains can cause writes outside the intended logical package layout. At minimum, an attacker can provide a substituted executable named `dwg2bmp`, which the script marks executable and the P ...[truncated 1147 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (46)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Delete the marker file to re-run full installation on next execution:
bash rm assets/.setup_donePoor screenshot quality
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document says the tool does not automatically install packages, but later states that the first run may automatically install dependencies and create a setup marker. Contradictory installation behavior is dangerous because users and agents may believe analysis is read-only while triggering package installs, downloads, or privileged setup actions.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md scripts/cad_tools.py
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh else log_info "Installing xvfb ..." if [ "$PKG_MANAGER" = "apt-get" ]; then sudo apt-get update -qq && sudo apt-get install -y -qq xvfb else sudo $PKG_MANAGER install -y xorg-x11-server-Xvfb 2>/dev/null || \ sudo $PKG_MANAGER install -y Xvfb 2>/dev/null || \
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh sudo rpm -i --replacefiles --nodeps "$ODA_RPM_PATH" 2>/dev/null || \ sudo $PKG_MANAGER localinstall --skip-broken -y "$ODA_RPM_PATH" 2>/dev/null elif [ "$EXT" = "deb" ]; then sudo dpkg -i "$ODA_RPM_PATH" 2>/dev/null || sudo apt-get install -f -y 2>/dev/null fi else # Attempt automatic download
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - **OS**: Linux x86_64 (Ubuntu/Debian/RHEL/CentOS supported) - **Python**: 3.8+ (system installed, other deps auto-installed) - **Permissions**: root or sudo (required for installing system packages on first setup) > macOS / Windows not supported (ODA File Converter and QCAD are Linux x86_64 only)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - **OS**: Linux x86_64 (Ubuntu/Debian/RHEL/CentOS supported) - **Python**: 3.8+ (system installed, other deps auto-installed) - **Permissions**: root or sudo (required for installing system packages on first setup) > macOS / Windows not supported (ODA File Converter and QCAD are Linux x86_64 only)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - **OS**: Linux x86_64 (Ubuntu/Debian/RHEL/CentOS supported) - **Python**: 3.8+ (system installed, other deps auto-installed) - **Permissions**: root or sudo (required for installing system packages on first setup) > macOS / Windows not supported (ODA File Converter and QCAD are Linux x86_64 only)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh - **OS**: Linux x86_64 (Ubuntu/Debian/RHEL/CentOS supported) - **Python**: 3.8+ (system installed, other deps auto-installed) - **Permissions**: root or sudo (required for installing system packages on first setup) > macOS / Windows not supported (ODA File Converter and QCAD are Linux x86_64 only)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh - **OS**: Linux x86_64 (Ubuntu/Debian/RHEL/CentOS supported) - **Python**: 3.8+ (system installed, other deps auto-installed) - **Permissions**: root or sudo (required for installing system packages on first setup) > macOS / Windows not supported (ODA File Converter and QCAD are Linux x86_64 only)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README states the skill auto-triggers whenever DWG/DXF/CAD drawings are mentioned, which is a broad activation condition for an agent-integrated skill. Over-broad triggering can cause the agent to invoke file-analysis and setup-related capabilities in conversations that merely mention CAD terms, increasing the chance of unintended tool use and exposure to risky follow-on actions such as environment setup or external dependency installation.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md **Permission errors on first run** setup.sh requires root permissions to install system packages. Please run as root or via sudo. **ODA automatic download fails**
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 83% confidence
- Finding
The document declares root/sudo as a requirement for installing packages and references auto-installation via setup.sh. While not inherently malicious, normalizing privileged execution for a skill materially raises risk because any flaw in the installer, dependency source, or future update path can lead to arbitrary system-wide changes or full host compromise.
- Content
md ## System Requirements - **OS**: Linux x86_64 (Ubuntu/Debian/RHEL/CentOS) - **Python**: 3.8+ - **Permissions**: root/sudo (required for installing system packages on first run) ## External Dependencies This Skill depends on the following external tools (auto-installed by setup.sh):
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The release notes explicitly state that the skill auto-installs external dependencies and requires root/sudo on first run, but they do not provide a clear warning, consent flow, or controls around system modification. In a skill ecosystem, encouraging privileged setup from bundled scripts increases supply-chain and host-compromise risk if the script or downloaded binaries are tampered with or behave unexpectedly.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill exposes shell, file read, and environment-sensitive behavior but does not declare any explicit tool scope or restrictions. That makes it easier for an agent to invoke broader capabilities than users would reasonably expect from a CAD viewer, increasing the chance of unintended command execution or filesystem access.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger list in the manifest includes generic terms such as "layer," "block," "entity," and "screenshot," plus "or any mention of .dwg/.dxf files." Several of these words are common outside this specific skill context, which makes invocation scope ambiguous and increases the risk of unintended activation.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 81% confidence
- Finding
The documented behavior implies that running ordinary commands may trigger setup-related side effects, while no tight tool boundaries are declared. In context, this broad execution model is risky because a seemingly simple CAD operation could invoke shell actions, installers, or other unintended commands.
- Content
md - The `{SKILL_DIR}` placeholder refers to the directory containing this SKILL.md file - **First run may take 1-3 minutes** as the tool automatically installs all dependencies - After first setup, a marker file is created at `assets/.setup_done` to skip future setup - To re-run setup (e.g. after system update), delete `assets/.setup_done` and run any command - DWG files require ODA File Converter for reading; DXF files can be read directly - Screenshot quality is best with QCAD dwg2bmp; matplotlib is a reasonable fallback - Large drawings may take several seconds to load — this is normal for complex engineering files
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest presents a CAD analysis utility, but the documentation adds persistent self-learning reads and writes in the user's project. This is a scope expansion not justified by the advertised function and creates hidden stateful behavior that can collect and reuse project-derived data across sessions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
A persistent cross-session memory mechanism in
.learning/is not necessary for a CAD viewer's core purpose and creates durable storage of user and project context. This can lead to data retention, unintended disclosure, and behavior influenced by stale or unrelated prior project information.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The self-learning feature instructs the agent to create and write project files automatically, but the nearby behavior description does not provide a prominent, explicit warning or consent gate. Silent modification of the user's workspace is risky because it persists data locally and can surprise users who expected read-only analysis.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Mandatory review and reuse of
.learning/files at the start of every task creates a built-in cross-session data retention channel. Even without obvious secrets, project-specific notes, prior errors, and preferences can leak context across tasks and influence future behavior in ways users did not request.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The logging guidance broadly instructs the agent to record corrections, preferences, errors, and discovered context into local files. That creates a durable repository of potentially sensitive project and user-derived information that may later be exposed to other sessions, tools, or collaborators with filesystem access.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Nearly all docstrings, CLI descriptions, help messages, and errors are presented only in Chinese. This imposes a fixed language/locale on all users without opt-in, which matches the policy category for language or locale constraints.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python missing = [] for pkg in ("ezdxf", "matplotlib"): try: __import__(pkg) except ImportError: missing.append(pkg)
Static analysis
No suspicious patterns detected.