Skills/ClawHub/cad-file-reader

cad-file-reader@0.39.7

CAUTION· install only

Publisher claims: "读取 DWG/DXF，提取标注、几何证据、图层/块语义、MEP 拓扑、图纸对比、钢结构/市政识图候选和规范图集索引；不输出最终工程量" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher lisong2003-lgtm · publishing for 34 daysInstalls 983Last detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-09 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Privileged sudo command; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 1 s · 2 scenarios
t+CategoryObserved action
0.2sprocessexited 1: ❌ vendor 安装后 import 校验未通过，请手动检查。
0.4sfilesystemread ~/.cache/codex-runtimes/ outside project
0.4sprocessexec /usr/bin/dirname
0.4sprocessexec /usr/bin/find
0.4sprocessexec /app/apps/web/node_modules/.bin/chmod
0.4sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/chmod
0.4sprocessexec /app/node_modules/.bin/chmod
0.4sprocessexec /pnpm/chmod
0.4sprocessexec /usr/local/sbin/chmod
0.4sprocessexec /usr/local/bin/chmod
0.4sprocessexec /usr/sbin/chmod
0.4sprocessexec /usr/bin/chmod
0.4sprocessexited 1: ❌ vendor 安装后 import 校验未通过，请手动检查。
0.4sprocessscript backend runs setup only
0.4sprocessscript backend runs setup only
0.5sprocesssecond launch, clock +45 days, CI unset
0.7sprocessexited 1: ❌ vendor 安装后 import 校验未通过，请手动检查。
1.0sfilesystemread ~/.cache/codex-runtimes/ outside project
1.0sprocessexec /usr/bin/dirname
1.0sprocessexec /usr/bin/find
1.0sprocessexited 1: ❌ vendor 安装后 import 校验未通过，请手动检查。

Static findings

HIGH
Privileged sudo commandscripts/doctor.py:71 · Privileged sudo command — agent may execute with elevated privileges"libredwg": ("sudo apt-get install -y libredwg-tools # Debian/Ubuntu；"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/doctor.py:74 · Privileged sudo command — agent may execute with elevated privileges"Fedora/RHEL/SUSE 用 sudo dnf install -y poppler-utils"),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/doctor.py:72 · Privileged sudo command — agent may execute with elevated privileges"Fedora/RHEL/SUSE 用 sudo dnf install -y libredwg-tools"),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/doctor.py:73 · Privileged sudo command — agent may execute with elevated privileges"poppler": ("sudo apt-get install -y poppler-utils # Debian/Ubuntu；"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/setup_linux.sh:40 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get install -y "${APT_PACKAGES[@]}"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/read_cad.py:378 · Python subprocess execution detectedsubprocess.run(command, cwd=str(outdir), timeout=120, check=False, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/cad_batch.py:104 · Python subprocess execution detectedproc = subprocess.run(cmd, capture_output=True, text=True, env=env, timeout=timeout)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/platform_paths.py:134 · File permission modification command — agent changes file ownership/permissions# Windows 用扩展名判定可执行性，不要求 chmod +x；Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Privileged sudo commandscripts/setup_linux.sh:39 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get update -yFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/cad_statesync.py:295 · Python subprocess execution detectedreturn subprocess.call(cmd)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/drawing_source.py:91 · Python subprocess execution detectedsubprocess.run([tool, "--help"], capture_output=True, timeout=10)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/run_preflight.sh:8 · File permission modification command — agent changes file ownership/permissionsfind "${SKILL_DIR}/scripts" -maxdepth 1 -type f -name "*.sh" -exec chmod +x {} + 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedscripts/doctor.py:192 · Python subprocess execution detectedproc = subprocess.run([str(python), "-V"], capture_output=True, text=True, timeout=10)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/cad_scan.py:344 · Python subprocess execution detectedcp = subprocess.run(cmd, capture_output=True, text=True, timeout=budget)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsscripts/setup.py:180 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = SKILL_DIR / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandscripts/setup_linux.sh:43 · Privileged sudo command — agent may execute with elevated privilegessudo dnf install -y python3-pip libredwg poppler-utils tesseract libreofficeFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/demo.sh:8 · File permission modification command — agent changes file ownership/permissionsfind "$SKILL_DIR/scripts" -maxdepth 1 -type f -name '*.sh' -exec chmod +x {} + 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedscripts/cad_pdf_ocr.py:138 · Python subprocess execution detectedproc = subprocess.run(args, capture_output=True, text=True, timeout=timeout)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsscripts/setup.py:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- 不修改系统级配置；全部写进技能目录下的 vendor/.env。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/cad_landscape_pdf.py:86 · Python subprocess execution detectedproc = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/drawing_source.py:133 · Python subprocess execution detectedproc = subprocess.run(cmd, capture_output=True, text=True, timeout=120)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/cad_pdf_ocr.py:673 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/install_vendor.sh:14 · File permission modification command — agent changes file ownership/permissionsfind "$SKILL_DIR/scripts" -maxdepth 1 -type f -name '*.sh' -exec chmod +x {} + 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Privileged sudo commandscripts/doctor.py:425 · Privileged sudo command — agent may execute with elevated privileges" 1) 首选安装 LibreDWG：sudo apt-get install -y libredwg-tools（Debian/Ubuntu；"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/cad_statesync_core.py:278 · Python subprocess execution detectedr = subprocess.run([sys.executable, str(client), "push",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/read_cad.py:394 · Python subprocess execution detectedsubprocess.run(command, timeout=180, check=False, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commandscripts/lint_cross_platform.py:67 · Privileged sudo command — agent may execute with elevated privileges"dylib 是 macOS 原生库格式。fix: 仓库内 sudo 二进制请走 platform 分支；Windows/Linux 由 pip wheel 提供"),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/ensure_runtime.sh:11 · File permission modification command — agent changes file ownership/permissionsfind "$SKILL_DIR/scripts" -maxdepth 1 -type f \( -name '*.sh' -o -name '*.py' \) ! -perm -u+x -exec chmod +x {} + 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedscripts/lint_cross_platform.py:105 · Python subprocess execution detected# 仅对命令类规则，在 .py 里只追 subprocess.run([...]) 这样的真实调用。Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/doctor.py:156 · Python subprocess execution detectedproc = subprocess.run([str(python), "-I", "-c", code],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commandscripts/setup_linux.sh:45 · Privileged sudo command — agent may execute with elevated privilegessudo yum install -y python3-pip libredwg poppler-utils tesseract libreofficeFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/cad_statesync_core.py:322 · Python subprocess execution detectedr = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/run_real_dwg_regression.py:60 · Python subprocess execution detectedreturn subprocess.run(cmd, text=True, **kw)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/self_test.py:435 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/self_test.py:255 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/setup_win.py:71 · Python subprocess execution detectedr = subprocess.run(cmd, env=env)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/setup.py:121 · Python subprocess execution detectedproc = subprocess.run([interpreter, "-c",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/setup.py:155 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/setup.py:92 · Python subprocess execution detectedsubprocess.run(cmd, check=True, timeout=1200)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/setup.py:112 · Python subprocess execution detectedsubprocess.run(["bash", str(install_sh)], check=True, timeout=1800)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/self_test.py:247 · Python subprocess execution detectedprobe = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/self_test.py:280 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/self_test.py:90 · Python subprocess execution detectedprobe = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/setup.py:75 · Python subprocess execution detectedproc = subprocess.run([interpreter, "-c", code], env=env, capture_output=True, text=True, timeout=120)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/setup_win.py:37 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/setup.sh:6 · File permission modification command — agent changes file ownership/permissionsfind "$SKILL_DIR/scripts" -maxdepth 1 -type f \( -name '*.sh' -o -name '*.py' \) ! -perm -u+x -exec chmod +x {} + 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05

Cost to the agent

Instructions loaded
≈8,993 tok
20 files · 190 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim lisong2003-lgtm: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  3. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim lisong2003-lgtmPropose a patch to the maintainer