Build123d Cad

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:51 PM UTC
• Version: 1.1.2

Overview

This CAD skill is coherent, but it should be reviewed because its claimed Python sandbox is bypassable and can allow host-level code execution or writes outside the intended CAD output directory.

Install only if you trust the CAD scripts the agent will run and can tolerate them executing with the same filesystem privileges as the OpenClaw account. Prefer running this skill inside a container or dedicated low-privilege account with a tightly scoped output directory, no network unless needed, and pinned dependency versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/helpers.py:35

Finding

Lexical sandbox bypass permits arbitrary host-level code execution

Content

View full analysis

str | None: """Check script for disallowed patterns. Returns error message or None if clean.""" for pattern in BLOCKED_PATTERNS: match = re.search(pattern, script) if match: return f"Blocked: script contains disallowed pattern '{match.group()}'" # Check imports — only allow whitelisted modules for match in re.finditer(r"(?:from|import)\s+([\w.]+)", script): module = match.group(1).split(".")[0] if module not in ALLOWED_IMPORTS: return f"Blocked: import of '{module}' is not allowed. Allowed: {', '.join(sorted(ALLOWED_IMPORTS))}" return None ``` ```python # scripts/helpers.py:78-100 def _extract_user_script(full_script: str) -> str | None: """Extract user code between marker comments, or return None if no markers.""" m = re.search( r"# --- user script ---\n(.*?)# --- end user script ---", full_script, re.DOTALL, ) return m.group ...[truncated 3871 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cad_generate.py:14

Finding

Unchecked output names allow writes outside the CAD workspace

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cad_validate.py:111

Finding

Unvalidated sweep parameters permit CPU and memory exhaustion

Content

View full analysis

Remediation

View remediation

MAX_SWEEP_POSES: raise ValueError("Too many sweep poses") ``` - Bound angular ranges and establish a safe minimum step size. - Limit the number and complexity of parts and sweeps per request. - Apply operating-system or container limits for CPU time, memory, process count, and output size. - Return a validation error immediately instead of relying on the global subprocess timeout. - Add tests for zero, negative, non-finite, and extremely small step values. ]]>

T08 · Insecure Dependencies

Note

• Location: SKILL.md:14

Finding

Unpinned third-party installation produces a non-reproducible supply chain

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill claims a narrow CAD generation/export purpose, but also supports assembly validation, swept-motion collision simulation, and arbitrary script-driven analysis. The broader actual behavior increases risk because hidden computation and execution capabilities may be invoked under a seemingly harmless CAD label, weakening trust assumptions and policy decisions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill claims a narrow CAD generation/export purpose, but also supports assembly validation, swept-motion collision simulation, and arbitrary script-driven analysis. The broader actual behavior increases risk because hidden computation and execution capabilities may be invoked under a seemingly harmless CAD label, weakening trust assumptions and policy decisions.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test_scripts.py (reported line 163)May include surrounding context.

python

def test_sandbox_blocks_open():
    out = run_script("cad_generate.py", [
        "--script", "open('/etc/passwd')",
        "--format", "step",
    ])
    assert not out["success"]

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

md

# clone into OpenClaw workspace skills
git clone https://github.com/xintlabs/build123d-cad.git ~/.openclaw/workspace/skills/build123d-cad

# create venv with Python 3.12 (build123d requires <=3.12 for OpenCascade wheels)
cd ~/.openclaw/workspace/skills/build123d-cad
uv venv --python 3.12
uv pip install build123d

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs use of Python and shell commands, creates a virtual environment, installs packages, and executes user-supplied Python scripts, yet it declares no explicit tool restrictions. That combination materially expands the attack surface because arbitrary script execution can access files, environment data, subprocesses, and potentially the network if the runtime permits it, while the skill metadata provides no least-privilege boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description says to use the skill when the user asks to "design, model, create, or export" 3D parts and components. Terms like "create" and "design" are broad everyday words, and the file does not provide exclusion conditions or negative examples to clarify when this skill should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code interpolates args.script directly into a generated Python program and executes it via run_sandboxed, which is a subprocess execution path. Although the module docstring mentions subprocess use, there is no confirmation prompt, user-facing log/print, or explicit warning about executing supplied code in the subprocess.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

When sweep mode runs, the code exports swept_{name}.step into the workspace, which is a file write affecting user data/storage. The operation occurs silently here: there is no visible confirmation, print/log message, or warning near the write path describing that artifacts will be created.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/helpers.py (reported line 122)May include surrounding context.

python

clean_env["PATH"] = f"{venv}/bin:{clean_env['PATH']}"

        try:
            proc = subprocess.run(
                [sys.executable, str(script_path)],
                capture_output=True, text=True,
                timeout=timeout, cwd=tmpdir, env=clean_env,

Tainted flow: 'clean_env' from os.environ.get (line 108, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 89% confidence

Finding

The child process environment is derived from host-controlled values, especially PATH and optionally VIRTUAL_ENV, and the interpreter used is inherited from sys.executable. In a hostile or multi-tenant deployment, an attacker who can influence the parent process environment could steer execution toward attacker-controlled binaries or libraries, weakening the claimed sandbox boundary and potentially enabling arbitrary code execution outside the intended trust model.

Content

Scanner excerpt · scripts/helpers.py (reported line 122)May include surrounding context.

python

clean_env["PATH"] = f"{venv}/bin:{clean_env['PATH']}"

        try:
            proc = subprocess.run(
                [sys.executable, str(script_path)],
                capture_output=True, text=True,
                timeout=timeout, cwd=tmpdir, env=clean_env,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_scripts.py (reported line 21)May include surrounding context.

python

def run_script(name: str, args: list[str]) -> dict:
    r = subprocess.run(
        [str(PYTHON), str(SCRIPTS / name)] + args,
        capture_output=True, text=True, timeout=60,
        cwd=str(SCRIPTS),

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstring states that result communication uses a JSON file and explicitly contrasts that with stdout parsing. However, output_json prints JSON to stdout and exits, which contradicts that stated execution model and could mislead maintainers about how results are returned.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This code file defines a helper that invokes external Python scripts via subprocess.run, which is a safety-relevant operation under the rule. While this is test code and the purpose is evident to a developer, there is no confirmation, user-facing log/print, or inline comment/docstring disclosing that the helper executes subprocesses.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.