Agent skill · Audited from source

solidworks-automation

skill · wzyn20051216/solidworks-automation-skillMIT licenceAudited 21 Oct 2026 · source ae913ff58c70

★ 1,323pushed 1 day ago
!CAUTIONGrade B · 81/100 · 19 findings · ae913ff
1,323repo stars · whole wzyn20051216/solidworks-automation-skill

Is it safe? With care — CAUTION, grade B (81/100). We read this skill's source at commit ae913ff58c70 and observed filesystem, network and shell access and no hard-coded secrets. The audit raised 19 findings, 0 critical or high. What it does: SolidWorks CAD 自动化技能,优先覆盖经验证的零件、孔槽、装配、工程图、导出和交付复核;所有能力等级以 capabilities.yaml 为准,未验证能力必须走人工复核。

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “solidworks-automation (wzyn20051216/solidworks-automation-skill)”. Retrieved 21 Oct 2026. https://modelsatlas.com/skills/wzyn20051216/solidworks-automation

Trust audit

Audit 0.4.1 · source read 21 Oct 2026

Trust score81/100!CAUTION B
0 critical0 high8 medium9 low2 info

CAUTION means the audit found things worth knowing before you trust this skill. Grade B is shared by 13,985 of 14,816 audited skills.

What the source does

  • FilesystemDeclared5 observations
  • NetworkDeclared10 observations
  • ShellDeclared4 observations
  • DependenciesNot pinnedSome versions float
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityWARN4
L1 Static sourceSecrets, path traversal, supply chain, hidden codeWARN15
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (19)

MEDIUMInventory / provenanceinv.binary · apps/workbench-ui/src-tauri/icons/icon.icns
F-13 Inventory / provenanceCWE-1104Layer L0
icon.icns
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
MEDIUMCode injectioncode.dynamic_import · scripts/sw_preflight.py:59
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
importlib.import_module(module_name)
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · ai_team/delivery-gate-e2e.cjs:72
F-04 Network egressCWE-200 · CWE-319Layer L1
const pathname = decodeURIComponent(new URL(request.url, "http://127.0.0.1").pathname);
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · ai_team/delivery-gate-e2e.cjs:115
F-04 Network egressCWE-200 · CWE-319Layer L1
const baseUrl = `http://127.0.0.1:${address.port}`;
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · ai_team/preview-viewport-e2e.cjs:188
F-04 Network egressCWE-200 · CWE-319Layer L1
const pathname = decodeURIComponent(new URL(request.url, "http://127.0.0.1").pathname);
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · ai_team/preview-viewport-e2e.cjs:333
F-04 Network egressCWE-200 · CWE-319Layer L1
const baseUrl = `http://127.0.0.1:${address.port}`;
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · ai_team/provider-ui-e2e.cjs:35
F-04 Network egressCWE-200 · CWE-319Layer L1
return (await fetch("http://127.0.0.1:9226/json/version")).ok;
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.base64_blob · dotnet/CadStudio.SolidWorks.AddinHost/CadStudio.AddinHost.snk.base64:1
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
BwIAAACkAABSU0EyAAgAAAEAAQDJatt5CCtVv9A/fgyq4l3dfVkDO8RXvspiT9sl2KNYePunCgw+QtzmABdwhSIEv8wux5oBY1uymSHcKsOm90PQmpFHo2JT+s+S6xm//irIKaAScqfX/DyG4j///+JtO64XKITTVmTAaa1wR7nvkhG4wp5bRALXEwz9qHivpHmxywqU
Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.hidden_file · .mcpbignore
F-13 Inventory / provenanceCWE-1104Layer L0
.mcpbignore
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWFilesystem / pathfs.traversal · tests/test_mcp_artifact_access.py:35
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
access.read("../../private.txt")
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.decode_call · apps/desktop/cad_workbench/mock_runner.py:25
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
PNG_1X1 = base64.b64decode(
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.decode_call · tests/test_mcp_http_transport.py:79
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
assert Image.open(io.BytesIO(base64.b64decode(picture.data))).size == (16, 16)
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.decode_call · tests/test_mcp_http_transport.py:81
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
restored = base64.b64decode(resource.contents[0].blob)
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainsupply.unpinned · apps/desktop/requirements.txt
F-08 Supply chainCWE-829 · CWE-1357Layer L1
PySide6
Why
1 requirement(s) not pinned with ==
Fix
pin exact versions
LOWSupply chainsupply.unpinned · apps/workbench-ui/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@phosphor-icons/react, @tauri-apps/api, @tauri-apps/plugin-dialog, @tauri-apps/plugin-updater, @vitejs/plugin-react, motion, react, react-dom
Why
17 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · mcp-server/requirements.txt
F-08 Supply chainCWE-829 · CWE-1357Layer L1
mcp, pydantic, jsonschema
Why
3 requirement(s) not pinned with ==
Fix
pin exact versions
LOWSupply chainsupply.unpinned · requirements.txt
F-08 Supply chainCWE-829 · CWE-1357Layer L1
mcp, pydantic, ezdxf, matplotlib, PyMuPDF, jsonschema
Why
6 requirement(s) not pinned with ==
Fix
pin exact versions
INFOInventory / provenanceinv.oversize · apps/workbench-ui/src/assets/default-blossom-wallpaper.mp4
F-13 Inventory / provenanceCWE-1104Layer L0
apps/workbench-ui/src/assets/default-blossom-wallpaper.mp4
Why
1285232 bytes not read
Fix
—
INFOInventory / provenanceinv.oversize · assets/showcase/solidworks-engineering-drawing-demo.gif
F-13 Inventory / provenanceCWE-1104Layer L0
assets/showcase/solidworks-engineering-drawing-demo.gif
Why
1166222 bytes not read
Fix
—

Audit 0.4.1 · source sha ae913ff58c70 · 21 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherwzyn20051216 GitHub userOwner of the repository this skill is read from
  • Source folderwzyn20051216/solidworks-automation-skillThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdictae913ff58c70A new audit runs when the source changes
  • Repository statusNot archivedLast push 1 day ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: SolidWorks CAD 自动化技能,优先覆盖经验证的零件、孔槽、装配、工程图、导出和交付复核;所有能力等级以 capabilities.yaml 为准,未验证能力必须走人工复核。

---
name: solidworks-automation
description: "SolidWorks CAD 自动化技能,优先覆盖经验证的零件、孔槽、装配、工程图、导出和交付复核;所有能力等级以 capabilities.yaml 为准,未验证能力必须走人工复核。"
metadata: { "openclaw": { "homepage": "https://github.com/wzyn20051216/solidworks-automation-skill", "os": ["win32"], "requires": { "anyBins": ["python", "py"] } } }
---

# SolidWorks 自动化技能

## 快速开始

### 环境要求

- Windows 系统;原生 SolidWorks 操作以 SolidWorks 2026 为支持与验收目标,开放格式无头写入不要求安装 CAD 软件
- Python 3.10+;原生 Windows CAD 自动化另需 `pywin32` / `comtypes`
- MCP/工具化调用需要 `mcp` / `pydantic`
- 工程图最终交付审查需要 `PyMuPDF`;它从 SolidWorks 导出 PDF 回读实际尺寸文字边界,已包含在 `requirements.txt`
- 处理 GLB/GLTF/OBJ/STL 网格参考模型时,可能还需要 `trimesh` / `pygltflib` / `numpy` / `Pillow`
- 如果通过 OpenClaw 使用,确保技能目录位于 `~/.openclaw/skills/solidworks-automation/` 或 `~/.agents/skills/solidworks-automation/`

### 入口自检

所有代理在执行 SolidWorks 自动化前,先运行技能自检:

```bash
python SKILL_DIR/scripts/sw_preflight.py
```

桌面端或 CLI 执行前建议先运行环境诊断:

```powershell
python SKILL_DIR/scripts/cad_studio.py doctor
```

`capabilities.yaml` 是 Skill、MCP、队列和 UI 共用的能力唯一真源。能力等级为 `verified`、`pilot`、`reference_only` 或 `not_implemented`;后两者不得作为无人值守交付。该清单还维护 Python、C# PIA/Add-in、原生 C++、SWBasic、OCCT 和外部求解器的原子操作路由;执行前可用 `python scripts/backend_router.py --list` 查询,规则见 `references/language-backend-routing.md`。

### 多入口与多后端

- CAD Studio 与 Skill/CLI/MCP 是平级入口,共用 Automation Job、NeutralCadDocument、Preview Manifest、Evidence Graph 和能力清单。
- 检测不到 SolidWorks/AutoCAD 时,只阻断 `SLDPRT/SLDASM/SLDDRW/DWG` 等原生格式;开放格式任务优先路由到 `headless_open_format_writing`。
- 无头写入使用 `scripts/headless_cad_writer.py`;OCCT/OCP 隔离进程真实写入 STEP、IGES、BREP、STL、OBJ、GLB,二维后端写入 DXF、SVG、PDF、PNG,并生成几何与 SHA-256 证据。
- DXF 交付会额外生成 `preview_scene`;已有 DXF 可通过 `python scripts/cad_studio.py preview-dxf --input drawing.dxf --output drawing.scene.json` 或 MCP `cadstudio_build_dxf_preview_scene` 转成受限 PreviewScene。该命令只读白名单实体并拒绝覆盖旧文件。
- OCCT 当前覆盖盒体、圆柱、布尔合并、圆柱孔切除、直纹/受限平滑 Loft、直线/单圆弧 Sweep、闭壳 Knit 和开放面 Thicken;复杂路径、自交偏置或缺少 OCP 运行时时保持 `blocked`。禁止通过改扩展名或空文件伪造支持。
- `delivery-preview` 只允许显示当前任务真实产物;固定样例必须标记 `demo-showcase` 与 `isDemo: true`,不得进入交付判断。

规则:

1. 检测到缺少 `comtypes` / `win32com` / `pythoncom` 时,向用户弹出友好确认:
   `检测到当前 Python 环境缺少 comtypes / win32com 库,是否授权 AI 自动为您配置本地环境?[Y/N]`
2. 用户输入 `Y` / `yes` 后,代理可在本地 shell 中自动执行 `python -m pip install "pywin32>=305" "comtypes>=1.2.0"` 补齐依赖;用户拒绝时停止并给出手动安装命令。
3. 检测不到 SolidWorks 安装或 COM 注册时,停止原生 SolidWorks 操作;若原生格式并非必需且 `fallbackPolicy=allow_open_formats`,继续执行无头开放格式后端,不要把整个任务误标为失败。

### Python 依赖提醒

按任务最小化安装依赖,不要在普通零件建模时强制安装网格转换库;工程图交付需要标准 `requirements.txt` 中的 PyMuPDF:

```powershell
# 核心 SolidWorks COM 自动化依赖
python -m pip install -r SKILL_DIR\requirements.txt

# 仅在需要 GLB/GLTF/OBJ/STL 网格检查、缩放或转换时安装
python -m pip install -r SKILL_DIR\requirements-mesh.txt
```

执行涉及 GLB/GLTF/FBX/BLEND 转 OBJ/STL 的任务前,先用 `importlib.util.find_spec()` 检查
`trimesh`、`pygltflib`、`PIL` 是否可用;缺失时先提示用户需要安装哪些库和用途,再安装或给出手动命令。

### 连接 SolidWorks

```python
import sys; sys.path.insert(0, r"SKILL_DIR/scripts")
from sw_connect import mm
from sw_part import sketch, sketch_circle, extrude_boss
from sw_sketch_quality import fully_define_sketch
from sw_session import SolidWorksSession

with SolidWorksSession(version=2026) as session:
    model = session.new_part()

    with sketch(model, "Front Plane") as sketch_name:
        sketch_circle(model, 0, 0, mm(25))
        fully_define_sketch(model)

    if extrude_boss(model, sketch_name, mm(50)) is None:
        raise RuntimeError("拉伸失败")
    if not session.save(model, r"C:\temp\cylinder.sldprt"):
        raise RuntimeError("保存失败")
    if not session.export(model, r"C:\temp\cylinder.step"):
        raise RuntimeError("导出失败")
```

> 将 `SKILL_DIR` 替换为此技能的实际安装路径。

模型交付要回读草图的约束状态、尺寸与关系,禁止批量 Fix 代替设计参数;保存重开后验证草图被目标特征消费、关键尺寸可改且孔位保持正确。基础圆/矩形可用 `fully_define_sketch()`;复杂草图应明确设计尺寸和关系,再用 `inspect_model_sketches()` 验收,缺证据时保留人工复核。

会话上下文只清理本轮登记的文档和确认归属的空实例;达到文档预算时先处理本轮文件。执行标记失败、重建失败、未知检查结果或人工复核尚未完成时,不得宣称任务完成。远程 MCP 通过 `artifact_refs` 取回 PNG 或原始文件并核对 SHA-256,规则见 `mcp-server/README.md`。

## 核心工作流

根据用户需求选择对应模块:

| 需求 | 脚本 | 参考文档 |
|---|---|---|
| 入口自检与依赖补齐 | `scripts/sw_preflight.py` | `references/troubleshooting.md` |
| 无 CAD 开放格式写入 | `scripts/headless_cad_writer.py`、`scripts/cad_studio.py write-open-format` | `capabilities.yaml`、公共 CAD Core Schema |
| 高级能力/类型库探测 | `scripts/sw_capability_probe.py` | `references/complex-mechanical-routing.md` |
| Python/C#/C++/SWBasic/OCCT 后端选择 | `scripts/backend_router.py` | `references/language-backend-routing.md`、`capabilities.yaml` |
| C# 进程内 Add-in 宿主、事件与 UI | `scripts/sw_addin_host.ps1`、`scripts/sw_addin_host.py` | `references/solidworks-addin-host.md` |
| 多模型宏生成防护 | `scripts/sw_macro_guard.py` | `references/openclaw.md` |
| 友好会话 API | `scripts/sw_session.py` | - |
| 连接与文档管理 | `scripts/sw_connect.py` | - |
| 外观与材质 | `scripts/sw_appearance.py` | `references/appearance.md` |
| 零件建模(草图+特征) | `scripts/sw_part.py` | `references/part-modeling.md` |
| 标准外啮合直齿轮实体 | `scripts/sw_gear.py` | `references/gears.md` |
| 盲孔/沉孔/沉头孔/半圆端槽与孔位验收 | `scripts/sw_hole_features.py`、`scripts/sw_review.py` | `references/complex-hole-features.md`、`references/review.md` |
| 自然语言到参数化设计计划 / VibeCAD | `subskills/solidworks-vibecad/scripts/plan_from_brief.py` | `subskills/solidworks-vibecad/SKILL.md`、`subskills/solidworks-vibecad/README.md` |
| 多圆角/倒角 CNC 机加工件 | `subskills/solidworks-fillet-chamfer-cnc/scripts/create_cnc_mount_template.py`;高级圆角用 `verify_advanced_fillets.py` | `subskills/solidworks-fillet-chamfer-cnc/SKILL.md`、`subskills/solidworks-fillet-chamfer-cnc/references/cnc-fillet-chamfer-lessons.md` |
| 螺丝孔/螺纹孔、攻丝底孔 | `subskills/solidworks-threaded-holes/scripts/create_threaded_hole_template.py` | `subskills/solidworks-threaded-holes/SKILL.md`、`subskills/solidworks-threaded-holes/references/threaded-hole-lessons.md` |
| AutoCAD DWG/DXF 二维绘图、线稿转 CAD、批量改图 | `subskills/autocad-automation/scripts/acad_draw.py`、`subskills/autocad-automation/scripts/acad_review.py` | `subskills/autocad-automation/SKILL.md`、`subskills/autocad-automation/references/troubleshooting.md` |
| 装

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit ae913ff

Download folder ↗
git clone https://github.com/yourusername/solidworks-automation-skill.git
npm install -g @smithery/cli
npm install
pip install pywin32
pip install -r mcp-server\requirements.txt
claude mcp add --scope user solidworks -- python C:\path\to\solidworks-automation-skill\mcp-server\server.py

Commands as the repository documents them: shown, never run by us. Our verdict covers commit ae913ff58c70 only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
Claude DesktopMentioned in its text, not testedSkills for Claude Desktop · About Claude Desktop
CodexMentioned in its text, not testedSkills for Codex · About Codex
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
Gemini CLIMentioned in its text, not testedSkills for Gemini CLI · About Gemini CLI
OpenClawMentioned in its text, not testedSkills for OpenClaw · About OpenClaw
WindsurfMentioned in its text, not testedSkills for Windsurf · About Windsurf
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. !CAUTION B 81 / 100

    first audit · source ae913ff58c70

README badge

For maintainers · shows the latest audit

ModelsAtlas: CAUTION BMODELSATLASCAUTION · B
[![ModelsAtlas: CAUTION B](https://modelsatlas.com/skills/wzyn20051216/solidworks-automation/badge.svg)](https://modelsatlas.com/skills/wzyn20051216/solidworks-automation/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Add this badge to your README

[![ModelsAtlas: CAUTION B](https://modelsatlas.com/skills/wzyn20051216/solidworks-automation/badge.svg)](https://modelsatlas.com/skills/wzyn20051216/solidworks-automation/)

Questions about solidworks-automation

What does the solidworks-automation skill do?
Reliable AI Skill + MCP toolkit for agent-driven desktop CAD automation.
Is solidworks-automation safe to install?
With care. The audit graded it B (81/100) and found 19 things worth knowing before you trust this skill, listed below with the exact line each was found on.
What can solidworks-automation access on my machine?
The audit observed that it reaches the network, runs shell commands and reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does solidworks-automation work with?
Its documentation mentions claude-code, claude-desktop, codex, cursor, gemini-cli, openclaw and windsurf. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (ae913ff58c70), read on 2026-10-21. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.