Mechanics Sketches

Generate technical engineering mechanics sketches (beams, supports, forces, moments, dimensions, coordinate systems) as PDF/PNG/SVG using the MechanicsSketch...

This skill appears to do what it says — generate and render mechanics sketches locally. Before installing or running: (1) review the upstream GitHub code if you plan to pip install from git+https://github.com/MatthiasHBusch/MechanicsSketches.git (pip installing from GitHub will fetch and execute code); (2) run it in a virtual environment to avoid contaminating your system Python and to contain PyQt5/matplotlib dependencies; (3) be mindful that the helper script will import the MechanicsSketches package via a relative sys.path insertion (it may pick up similarly named modules in parent directories), and it reads the input JSON and writes the output path you provide — only supply trusted JSON input and output locations; (4) if you need a fully offline setup, mirror/review the repo first, because the setup instruction triggers network access during installation.

Type: OpenClaw Skill Name: mechanics-sketches Version: 1.0.0 The skill is classified as suspicious due to potential file path traversal vulnerabilities in `scripts/generate_sketch.py`, where user-provided input and output file paths are used directly without sanitization, potentially allowing writes to arbitrary file system locations. Additionally, the `SKILL.md` instructs the agent to install the core library directly from a GitHub URL (`pip install git+https://github.com/MatthiasHBusch/MechanicsSketches.git`), which introduces a supply chain risk if the remote repository were compromised. No evidence of intentional malicious behavior like data exfiltration or arbitrary code execution was found, and the skill explicitly states it makes no network requests, which was verified.