Security audit

Cad Agent 1.0.0

Security checks for vulnerabilities and agentic risk

Overview

This CAD skill is purpose-aligned, but it asks users to build and run mutable remote code and exposes a code-execution CAD API without documented access controls.

Review this carefully before installing. Only run it if you trust the cad-agent repository and preferably pin it to a specific reviewed commit. Bind the service to 127.0.0.1, do not expose port 8123 to untrusted networks, avoid host mounts and Docker socket access, run with minimal privileges, and stop/remove the background container when finished.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:34
Finding: Unpinned Remote Repository Is Retrieved, Built, and Executed
Content: View full analysis
Remediation: View remediation
`. 4. Prefer distributing reviewed installation and runtime code inside the audited skill package. 5. Lock all transitive dependencies and verify their integrity during the build. 6. Use a multi-stage, reproducible build with a minimal trusted base image pinned by digest. 7. Document the expected repository commit and image digest in `SKILL.md`. 8. Run builds and containers with minimal privileges, no Docker socket, no unnecessary host mounts, restricted capabilities, and limited network access. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:47
Finding: Unauthenticated Network Exposure of an Arbitrary Python Code Execution API
Content: View full analysis
Remediation: View remediation
serve ``` 2. Require strong authentication and authorization for every code-execution endpoint. 3. Do not expose the service directly to untrusted networks. If remote access is necessary, place it behind an authenticated TLS reverse proxy or mutually authenticated tunnel. 4. Replace unrestricted Python execution with a narrowly scoped declarative modeling format where possible. 5. If Python execution is essential, run each request in a disposable sandbox with strict CPU, memory, process, execution-time, and filesystem limits. 6. Run as a dedicated non-root user with a read-only root filesystem and a minimal writable workspace. 7. Drop all unnecessary Linux capabilities, enable `no-new-privileges`, use a restrictive seccomp/AppArmor profile, and never mount the Docker socket. 8. Disable outbound network access unless explicitly required. 9. Avoid host filesystem mounts; where unavoidable, use narrowly scoped read-only mounts. 10. Add request-size limits, rate limiting, execution timeouts, audit logging, and automatic termination of abusive workloads. 11. Document the service’s trust boundary and clearly warn that the code-execution endpoints must not be reachable by untrusted clients. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

External Transmission