openscad-skillCAUTION

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: openscad
description: Create 3D models with OpenSCAD. Use when the user wants to design a 3D-printable part, a parametric model, an enclosure/bracket/gadget, or asks to write or render .scad code, export STL, or see a preview of a 3D shape. Also for multi-part assemblies, moving mechanisms, print-ready files (3MF, multi-material) and laser-cut or sheet-metal flat parts (DXF cut files).
---

# OpenSCAD

Parametric `.scad` → STL + numbers. 1 unit = 1 mm.

**Run scripts through their interpreter** — `bash scripts/x.sh`, `python3 scripts/x.py` — never as `scripts/x.sh`: uploaded skills are mounted read-only without the executable bit. Outputs go next to the model, never into the skill folder.

**Setup:** run `bash scripts/setup.sh` once. It installs the fast engine (OpenSCAD 2025 + Manifold; the WebAssembly build via npm if no native one has it, no sudo) and native OpenSCAD for PNGs, refreshing the package index itself. Exit 4 `NEEDS_SUDO` = nothing can render: relay the printed command, wait, continue. "PNG previews unavailable" is not a blocker — work from numbers. `bash scripts/oscad.sh --which` shows the engine.

## Token economy — follow strictly

- **Numbers before pixels.** Verify with the bbox / volume / watertight line every export prints, `--diff old.stl`, and the checks below. Each viewed image ≈ 1k tokens; numbers are more reliable than vision for dimensions.
- **When numbers don't suffice** (internal fits, sculpted surfaces, "is anything there?"): next step is a **2D section** — `bash scripts/render.sh --cut y=12` or `python3 scripts/asm.py --section y=12` — which also prints extents, in-plane overlaps and gaps. A shaded view (`--view`, `--cut3d`) comes after that, only for topology numbers and sections can't confirm.
- Iterate with `--no-png`. Edit the `.scad` with targeted string replacements, never full-file rewrites.
- `.scad` style: one params block at top — readable names, brief comment per line. Then optionally one `// derived` block (computed heights/offsets, one comment each) or a `report` table (below). Below that: short names (`w,h,d,r,t,k`), zero comments.
- Human-facing output is interactive 3D, never PNGs: `--html` for the deliverable (cut plane, tap-to-measure, pull-apart, variants), `--mark3d` for mid-design confirmation. Present both WITHOUT viewing.

## Workflow

1. Clarify size / holes / tolerances; for vague asks pick sensible defaults and state them. Standard interfaces (ATX, PSU, fan, rack, connector patterns): look up a dimensioned source every time, never from memory or old notes; say which numbers are unverified and suggest a 1:1 paper print before cutting.
2. Write the `.scad` (open `reference/cheatsheet.md` only if unsure of a specific detail).
3. `bash scripts/render.sh model.scad --no-png` → STL + bbox/volume. Non-zero exit, `ERROR:`, `NOT WATERTIGHT` or `NON-MANIFOLD` = fix first.
4. Check numbers against intent; after edits `--diff previous.stl`; internals: `--cut PLANE`.
5. Final: `bash scripts/render.sh model.scad --html` (single part) or `python3 scripts/asm.py model.scad --html` (assembly).

## Gotchas

- `$fn`: 64 iterating, 128+ final curves, 32 small holes.
- `difference()`: first child is the body. Overshoot cuts (`h+0.2` at `z=-0.1`).
- **Never put a cutter face tangent to a curved surface or on the same radius as a profile** (e.g. a cube face at `y = r` against a cylinder of radius `r`) — it leaves an open or non-manifold mesh that other tools reject. Offset ≥ 0.5 mm. Solids touching only along an edge give `NON-MANIFOLD`: overlap them or separate them.
- FDM fits (on diameter): slide +0.2, press +0.1, free +0.4; M3 clearance 3.4 mm; M3 heat-set 4.0 × 5 deep. Walls ≥ 1.2; >45° overhang needs support; `minkowski()`/`hull()` are slow.
- `cube()` is corner-at-origin; pass `center=true` deliberately.
- **Fasteners:** for every screw/nut, state which side the driver comes from and at which assembly step; check it is still reachable after parts that go on later (springs, boards, glued inlays). No check catches this.
- **Freeform blends:** a CSG cutter leaves a crease where it meets the surface. For a feature that must fade in smoothly (thumb dish, grip), copy `lib/loft.scad` beside the model and displace the profile instead:

```scad
use <loft.scad>
prof = [for (t=[0:24]) [15 - 3*pow(t/24,2), 30*t/24]];          // [r,z] bottom→top
dish = function(a,i,p) let(w = smooth01(1 - abs(((a+180)%360)-180)/60),  // ±60° fade
                            h = smooth01((p[1]-8)/14) * smooth01((26-p[1])/4))
       [p[0] - 2.5*w*h, p[1]];
rev_loft(concat(prof, [[0,30]]), n=120, mod=dish);               // r=0 end closes on axis
```

## BOSL2 (threads, fillets, gears — fetch on demand only)

`bash scripts/get_bosl2.sh` once, then:

```scad
include <BOSL2/std.scad>
include <BOSL2/threading.scad>        // only when threading
cuboid([30,20,10], rounding=2);       // filleted box, no minkowski
threaded_rod(d=10, l=20, pitch=1.5);
```

## Assemblies

Tables near the top of the `.scad`, the single source every tool reads. Values may be expressions, but OpenSCAD reads top to bottom, so put the tables **after** the parameters and derived values they use (a table above them sees `undef`). `parts`, `checks`, `travel`, `report`, `variants`, `variant`, `bends`, `k_factor` and `part` are reserved names: don't use them for your own parameters (asm.py stops with a name-clash message).

```scad
part = "all";
knob_h = 18;                      // parameters and derived values first ...
z0 = 12.4;                        // knob underside
// ... then the tables that use them
variant = "dome";  variants = ["dome","dish"];    // optional: each variant exported as its own set
parts = [ // id, label, note, pull-apart [x,y,z], "#colour", tags — only id is required
  ["base","Base","PETG",[0,0,-20],"print=auto"],
  ["knob","Knob","PETG",[0,0,25],"group=knob","print=x180"],
  ["inlay","Grip inlay","TPU",[0,0,35],"group=knob","plate=knobset","mat=TPU"],
  ["spring","Return spr

CAUTIONgrade B · trust 81/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

declared (5 observation(s))

Network

declared (1 observation(s))

Shell

declared (4 observation(s))

Dependencies

pinned

Secrets in source

none-found

Findings (6)

return __import__(mod)

return __import__(mod)

return __import__(mod)

return __import__(mod)

h = hashlib.sha1(extra.encode())

"hash": hashlib.sha1(tri.astype(np.float32).tobytes()).hexdigest()[:16], "open": op, "nonman": nm}

Gates applied: no_behavioural_pass.