ClawHub
Back to skill

Security audit

SOLIDWORKS Modeling

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a genuine SOLIDWORKS automation skill, but it can close or overwrite CAD work without clear confirmation.

Review before installing. Use it only on a Windows machine where SOLIDWORKS automation is intended, save or close unrelated SOLIDWORKS documents first, and run examples in a scratch directory or on copied CAD files. Consider removing the close_all calls and adding backup/unique-output behavior before using it on production models or batch folders.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/sw_api.py:89
Finding

Unconditional Closure of Unrelated SOLIDWORKS Documents

Content
View full analysis

Vulnerability Details

File Location: scripts/sw_api.py:89-93, invoked by all supplied build scripts immediately after connecting to SOLIDWORKS
Vulnerability Type: Unconfirmed destructive operation affecting unrelated application state
Risk Level: Medium

Complete Code Snippet

python
def close_all(sw):
    try:
        sw.CloseAllDocuments(True)
    except Exception:
        pass

Representative invocation:

python
sw = connect()
close_all(sw)

The invocation occurs at:

  • scripts/build_assembly.py:25-26
  • scripts/build_cup_shell.py:10-11
  • scripts/build_drawing.py:12-13
  • scripts/build_flange.py:10-11
  • scripts/build_flower.py:25-26
  • scripts/build_gear.py:98-99
  • scripts/build_hook.py:16-17
  • scripts/build_hook_loft.py:24-25
  • scripts/build_mug.py:21-22
  • scripts/build_spring.py:10-11

Technical Analysis

The connection helper can attach to an already-running SOLIDWORKS instance. Every supplied build script then calls close_all(sw) unconditionally. The helper invokes CloseAllDocuments(True) without checking which documents were opened by the Skill, whether existing documents contain unsaved changes, or whether the user authorized closing unrelated work.

The Skill documentation describes modeling and file-conversion operations, but the executable path expands a request to build one model into a bulk operation against all documents in the attached SOLIDWORKS session. There is no explicit opt-in flag, confirmation gate, dry-run mode, ownership tracking, or backup step. The broad exception handler also suppresses failures, reducing visibility into whether documents were partially closed.

This is a reachable destructive behavior rather than evidence of malicious intent.

Attack Path

  1. The user has one or more documents open in an existing SOLIDWORKS session, potentially with unsaved changes.
  2. The user invokes any supplied build script to create the script's advertised model.
  3. connect() at ...[truncated 820 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the unconditional close_all(sw) calls from the build scripts.
  • Track documents created or opened by the current script and close only those documents by exact title or document identity.
  • Before closing any pre-existing document, inspect its modified or unsaved state and request explicit user confirmation.
  • If bulk closure is operationally necessary, require an explicit command-line opt-in such as --close-all-documents; default to preserving existing documents.
  • Provide a dry-run or enumeration mode that lists affected documents before performing closure.
  • Do not suppress all exceptions. Report closure failures and stop safely if document ownership or save state cannot be established.
  • Consider launching a dedicated SOLIDWORKS instance for automation where supported, isolating the task from the user's interactive session.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (29)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill describes capabilities that involve reading local files and operating on local CAD documents, but it does not declare an explicit tool scope such as allowed-tools or permissions. In an agent setting, missing scope boundaries increases the chance of unintended file access or misuse of local resources because the runtime cannot easily constrain what the skill is permitted to touch.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation text uses broad triggers like '画/建模/出图/批量转换格式/修改模型' and mentions common file extensions, which can cause the agent to invoke this powerful local-automation skill too eagerly. Because the skill can open, modify, save, and export real CAD files through COM on the host machine, overbroad routing raises the risk of unintended destructive actions on user data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description states the skill can open, modify, and save existing .SLDPRT/.SLDASM/.SLDDRW files, but it does not clearly warn that these operations may overwrite or alter valuable engineering documents. In this context, the omission is more dangerous because CAD files are often business-critical and modifications through the COM API can be fast, batch-oriented, and difficult to reverse if versioning is absent.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

L140 要求使用诸如“*前视”等本地化视图名，且全文多处默认使用中文界面命名。该自然语言指导隐含要求特定语言/区域设置才能正常使用，但未说明仅适用于中文环境，也未提供其他语言界面的替代方案或用户选择。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

L174 明确示例使用中文本地化基准面名称“前视基准面”，并表述为稳定做法，但没有声明这仅适用于中文界面。对于非中文环境，这种默认语言绑定构成了语言/locale 约束，缺少显式的用户选择或适用范围说明。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file's primary natural-language instructions and descriptions are entirely in Chinese, and there is no indication that users may choose another language or that the skill is limited to a Chinese-only deployment context. This creates a language/locale policy concern under the rule for skills that force a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The top-level docstring is entirely in Chinese and presents the skill behavior only in that language, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script unconditionally deletes any existing target files before saving, with no confirmation, backup, or path safety checks. In this skill context, the outputs are engineering drawing artifacts, so accidental overwrite or deletion can destroy prior work product or approved documents if the script is run in the wrong directory or against reused filenames.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module docstring is entirely in Chinese and presents the skill as Chinese-localized by default, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file's natural-language content, including the module docstring, comments, output filenames, and log context, is entirely in Chinese, with no indication that language selection is optional or that the skill is intentionally region-specific. This can violate language/locale policy when a specific language is imposed without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring describing the skill is entirely in Chinese, which imposes a specific language on users and maintainers without offering an alternative or opt-in. Under the policy, locale or language constraints should either be optional or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script presents natural-language content in Chinese, including the module description and generated file/view labels, with no indication that the user can choose another language. This can violate language/locale policy when a skill imposes a specific language rather than offering or documenting locale selection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This skill contains natural-language instructions and descriptions exclusively in Chinese, including the primary docstring and operational comments. Under the policy, forcing a specific language without user opt-in or clear justification is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The docstring and output filenames are written in Chinese, which imposes a specific language/locale on user-visible behavior. There is no indication that the skill is region-specific or that users can opt into another language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The call to close_all(sw) will close all open SOLIDWORKS documents immediately, which can disrupt active user work and may cause data loss if there are unsaved changes. In a local desktop CAD environment, this side effect is more dangerous because users often keep multiple valuable models open while automations run.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The save_part() and export_png() functions unconditionally delete any existing file at the target path before saving, with no validation, confirmation, backup, or path restrictions. In an agent setting where output paths may be influenced by prompts or upstream tooling, this can cause unintended data loss or overwrite arbitrary user files accessible to the current Windows account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

L086 描述了遍历目录后执行 OpenDoc6、处理、SaveAs 和 CloseDoc 的批量流程，这会批量修改或导出文件。该段没有提示可能覆盖文件、批量处理失败影响范围或建议先备份，属于会影响用户数据的行为但缺少明显用户警示。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script saves a SolidWorks part file and exports multiple PNG files, which modifies the filesystem. Although there are internal log calls, there is no explicit user-facing warning, confirmation, comment warning, or docstring disclosure that the skill will write these output files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The module docstring at L02 is written in Chinese and describes the skill in a fixed locale without offering any language choice. Under the stated policy, forcing a specific language or locale in user-facing natural-language content can be a policy violation unless the constraint is documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script saves a SolidWorks part file and exports a PNG preview, which modifies the filesystem by creating or overwriting files in the script directory. While there is logging after the fact, there is no confirmation prompt or explicit warning/comment disclosing that running the skill will write output files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The script writes a SolidWorks part file and a PNG preview to disk via save_part and export_png, but there is no confirmation prompt, comment warning, or user-facing disclosure near these operations. For code files, file writes can be flagged when they lack any form of disclosure and are not explicitly communicated to the user in the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code writes a SolidWorks part file and multiple PNG files to disk via save_part and SaveAs/export functions. While file output is central to the script's purpose, there is no docstring, inline warning, or user-facing disclosure near these operations explaining that files will be created or overwritten in the script directory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The script constructs output paths for a SolidWorks part and PNG preview, then later saves those files to disk. While file output is part of the script's purpose, the file header only states how to run it and where dimensions are set, without explicitly warning that running the script will create or overwrite files in the chosen output directory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The module docstring is written entirely in Chinese and presents the skill description in a single language without offering any language choice or opt-in. Under the stated policy, forcing a specific language can be a natural-language policy violation when no alternative or user selection is provided.

Content

No source excerpt is available for this finding.