Security audit

SOLIDWORKS Modeling

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a genuine SOLIDWORKS automation skill, but it can close or overwrite CAD work without clear confirmation.

Review before installing. Use it only on a Windows machine where SOLIDWORKS automation is intended, save or close unrelated SOLIDWORKS documents first, and run examples in a scratch directory or on copied CAD files. Consider removing the close_all calls and adding backup/unique-output behavior before using it on production models or batch folders.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/sw_api.py:89
Finding: Unconditional Closure of Unrelated SOLIDWORKS Documents## Vulnerability Details **File Location**: `scripts/sw_api.py:89-93`, invoked by all supplied build scripts immediately after connecting to SOLIDWORKS **Vulnerability Type**: Unconfirmed destructive operation affecting unrelated application state **Risk Level**: Medium ### Complete Code Snippet ```python def close_all(sw): try: sw.CloseAllDocuments(True) except Exception: pass ``` Representative invocation: ```python sw = connect() close_all(sw) ``` The invocation occurs at: - `scripts/build_assembly.py:25-26` - `scripts/build_cup_shell.py:10-11` - `scripts/build_drawing.py:12-13` - `scripts/build_flange.py:10-11` - `scripts/build_flower.py:25-26` - `scripts/build_gear.py:98-99` - `scripts/build_hook.py:16-17` - `scripts/build_hook_loft.py:24-25` - `scripts/build_mug.py:21-22` - `scripts/build_spring.py:10-11` ### Technical Analysis The connection helper can attach to an already-running SOLIDWORKS instance. Every supplied build script then calls `close_all(sw)` unconditionally. The helper invokes `CloseAllDocuments(True)` without checking which documents were opened by the Skill, whether existing documents contain unsaved changes, or whether the user authorized closing unrelated work. The Skill documentation describes modeling and file-conversion operations, but the executable path expands a request to build one model into a bulk operation against all documents in the attached SOLIDWORKS session. There is no explicit opt-in flag, confirmation gate, dry-run mode, ownership tracking, or backup step. The broad exception handler also suppresses failures, reducing visibility into whether documents were partially closed. This is a reachable destructive behavior rather than evidence of malicious intent. ### Attack Path 1. The user has one or more documents open in an existing SOLIDWORKS session, potentially with unsaved changes. 2. The user invokes any supplied build script to create the script's advertised model. 3. `connect()` at ...[truncated 820 chars]
Remediation: ## Remediation Suggestions - Remove the unconditional `close_all(sw)` calls from the build scripts. - Track documents created or opened by the current script and close only those documents by exact title or document identity. - Before closing any pre-existing document, inspect its modified or unsaved state and request explicit user confirmation. - If bulk closure is operationally necessary, require an explicit command-line opt-in such as `--close-all-documents`; default to preserving existing documents. - Provide a dry-run or enumeration mode that lists affected documents before performing closure. - Do not suppress all exceptions. Report closure failures and stop safely if document ownership or save state cannot be established. - Consider launching a dedicated SOLIDWORKS instance for automation where supported, isolating the task from the user's interactive session.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (29)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill describes capabilities that involve reading local files and operating on local CAD documents, but it does not declare an explicit tool scope such as allowed-tools or permissions. In an agent setting, missing scope boundaries increases the chance of unintended file access or misuse of local resources because the runtime cannot easily constrain what the skill is permitted to touch.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The activation text uses broad triggers like '画/建模/出图/批量转换格式/修改模型' and mentions common file extensions, which can cause the agent to invoke this powerful local-automation skill too eagerly. Because the skill can open, modify, save, and export real CAD files through COM on the host machine, overbroad routing raises the risk of unintended destructive actions on user data.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The description states the skill can open, modify, and save existing .SLDPRT/.SLDASM/.SLDDRW files, but it does not clearly warn that these operations may overwrite or alter valuable engineering documents. In this context, the omission is more dangerous because CAD files are often business-critical and modifications through the COM API can be fast, batch-oriented, and difficult to reverse if versioning is absent.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: L140 要求使用诸如“*前视”等本地化视图名，且全文多处默认使用中文界面命名。该自然语言指导隐含要求特定语言/区域设置才能正常使用，但未说明仅适用于中文环境，也未提供其他语言界面的替代方案或用户选择。

Natural-Language Policy Violations

Medium

Confidence: 86% confidence
Finding: L174 明确示例使用中文本地化基准面名称“前视基准面”，并表述为稳定做法，但没有声明这仅适用于中文界面。对于非中文环境，这种默认语言绑定构成了语言/locale 约束，缺少显式的用户选择或适用范围说明。

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The file's primary natural-language instructions and descriptions are entirely in Chinese, and there is no indication that users may choose another language or that the skill is limited to a Chinese-only deployment context. This creates a language/locale policy concern under the rule for skills that force a specific language without user opt-in.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The top-level docstring is entirely in Chinese and presents the skill behavior only in that language, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script unconditionally deletes any existing target files before saving, with no confirmation, backup, or path safety checks. In this skill context, the outputs are engineering drawing artifacts, so accidental overwrite or deletion can destroy prior work product or approved documents if the script is run in the wrong directory or against reused filenames.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The module docstring is entirely in Chinese and presents the skill as Chinese-localized by default, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless clearly justified as region-specific.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The file's natural-language content, including the module docstring, comments, output filenames, and log context, is entirely in Chinese, with no indication that language selection is optional or that the skill is intentionally region-specific. This can violate language/locale policy when a specific language is imposed without user opt-in.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The module docstring describing the skill is entirely in Chinese, which imposes a specific language on users and maintainers without offering an alternative or opt-in. Under the policy, locale or language constraints should either be optional or clearly justified as region-specific.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The script presents natural-language content in Chinese, including the module description and generated file/view labels, with no indication that the user can choose another language. This can violate language/locale policy when a skill imposes a specific language rather than offering or documenting locale selection.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: This skill contains natural-language instructions and descriptions exclusively in Chinese, including the primary docstring and operational comments. Under the policy, forcing a specific language without user opt-in or clear justification is a language/locale policy violation.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The docstring and output filenames are written in Chinese, which imposes a specific language/locale on user-visible behavior. There is no indication that the skill is region-specific or that users can opt into another language.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The call to close_all(sw) will close all open SOLIDWORKS documents immediately, which can disrupt active user work and may cause data loss if there are unsaved changes. In a local desktop CAD environment, this side effect is more dangerous because users often keep multiple valuable models open while automations run.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The save_part() and export_png() functions unconditionally delete any existing file at the target path before saving, with no validation, confirmation, backup, or path restrictions. In an agent setting where output paths may be influenced by prompts or upstream tooling, this can cause unintended data loss or overwrite arbitrary user files accessible to the current Windows account.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: L086 描述了遍历目录后执行 OpenDoc6、处理、SaveAs 和 CloseDoc 的批量流程，这会批量修改或导出文件。该段没有提示可能覆盖文件、批量处理失败影响范围或建议先备份，属于会影响用户数据的行为但缺少明显用户警示。

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The script saves a SolidWorks part file and exports multiple PNG files, which modifies the filesystem. Although there are internal log calls, there is no explicit user-facing warning, confirmation, comment warning, or docstring disclosure that the skill will write these output files.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The module docstring at L02 is written in Chinese and describes the skill in a fixed locale without offering any language choice. Under the stated policy, forcing a specific language or locale in user-facing natural-language content can be a policy violation unless the constraint is documented and justified.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The script saves a SolidWorks part file and exports a PNG preview, which modifies the filesystem by creating or overwriting files in the script directory. While there is logging after the fact, there is no confirmation prompt or explicit warning/comment disclosing that running the skill will write output files.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The script writes a SolidWorks part file and a PNG preview to disk via `save_part` and `export_png`, but there is no confirmation prompt, comment warning, or user-facing disclosure near these operations. For code files, file writes can be flagged when they lack any form of disclosure and are not explicitly communicated to the user in the file.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: This code writes a SolidWorks part file and multiple PNG files to disk via save_part and SaveAs/export functions. While file output is central to the script's purpose, there is no docstring, inline warning, or user-facing disclosure near these operations explaining that files will be created or overwritten in the script directory.

Missing User Warnings

Low

Confidence: 79% confidence
Finding: The script constructs output paths for a SolidWorks part and PNG preview, then later saves those files to disk. While file output is part of the script's purpose, the file header only states how to run it and where dimensions are set, without explicitly warning that running the script will create or overwrite files in the chosen output directory.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: The module docstring is written entirely in Chinese and presents the skill description in a single language without offering any language choice or opt-in. Under the stated policy, forcing a specific language can be a natural-language policy violation when no alternative or user selection is provided.

Static analysis

No suspicious patterns detected.