Is clawd-maf/cad-agent safe?
https://github.com/openclaw/skills/tree/main/skills/clawd-maf/cad-agent
CAD Agent is a legitimate CAD rendering tool that uses Docker containers for 3D modeling operations. However, it shows concerning behavior during installation by accessing sensitive system files and requires external code execution that could pose security risks.
Category Scores
Findings (5)
HIGH Sensitive file access during installation -40 ▶
The skill installation process accessed multiple sensitive canary files including .env, SSH keys, AWS credentials, and other configuration files. While no exfiltration was detected, this access pattern is concerning.
MEDIUM External code execution via Docker -30 ▶
The skill requires cloning an external repository and executing Docker containers, which could be compromised to execute malicious code. The Docker container runs a local HTTP server on port 8123.
MEDIUM Local HTTP server security risk -25 ▶
The skill opens a local HTTP server on port 8123 which could present an attack surface for malicious requests or unauthorized access to CAD operations.
LOW Canary file access without modification -20 ▶
Sensitive canary files were accessed during installation but not modified, indicating potential reconnaissance behavior.
LOW External URL references -5 ▶
The skill references external URLs that could potentially be fetched by the agent, including GitHub repositories and documentation sites.