cad-agent.Supply-chain and resource report
What cad-agent depends on, vendors and links to, checked on 2026-11-01 at revision 88ff87ffc253 (online checks). Findings: 1 critical, 24 low, 9 info. Generated by tools/resource_audit.py; how to read it and what blocks a merge are in the cad-supply-chain skill and on the supply-chain page.
Limits. A clean report is not proof of safety: what each check can and cannot see
- A clean report is not proof of safety: advisory databases (OSV, the npm registry) only know what has been reported.
- Licences come from licence files and registry metadata (GitHub, PyPI, npm), matched by keyword; they are not a legal review.
- Link checks see status codes and redirects, not content: a parked or replaced page that answers 200 passes. Domain expiry is not checked.
- GitHub links are checked at repository level; a missing file or anchor inside a live repository is not seen.
- Python versions are checked at the newest release and the lowest release our range allows, not at every version in between.
- Transitive Python dependencies are checked at the versions deps.dev resolves for our newest direct releases; an existing environment may hold other versions, and --installed checks only the installed versions of our direct dependencies.
- Libraries bundled inside a vendored file (DOMPurify and KaTeX inside mermaid.min.js) are checked at the versions its receipt records; whether the bundling library reaches the affected code is not assessed.
- Repository settings (secret scanning, Dependabot) are read only with an admin token; the weekly workflow cannot see them.
- Offline mode checks only what the checkout shows (pins, hashes, licence files, lockfile, link schemes, install advice).
Findings
Critical (1)
| Severity | Subject | Finding | Evidence | Action |
|---|---|---|---|---|
| critical | webkit:mermaid |
dompurify 3.4.12, bundled inside a vendored file, has 5 known advisories | GHSA-cg2g-xh64-v4q7 (critical, fixed in 3.4.17): DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes; GHSA-mrv2-3pqr-j5jr (high, fixed in 3.4.17): DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached sub | dompurify comes inside another library's file: take the first release of that library that bundles dompurify >=3.4.17, and say in the receipt whether the affected code is reachable. |
Low (24)
24 low: 21 repo-stale, 2 dependabot-ecosystem, 1 advisory
Table 24 rows: Severity, Subject, Finding, Evidence, …
| Severity | Subject | Finding | Evidence | Action |
|---|---|---|---|---|
| low | webkit:mermaid |
katex 0.16.47, bundled inside a vendored file, has 1 known advisory | GHSA-238p-pmpm-9mq7 (low, fixed in 0.18.2): KaTeX: Existing prototype pollution can bypass trust restrictions | katex comes inside another library's file: take the first release of that library that bundles katex >=0.18.2, and say in the receipt whether the affected code is reachable. |
| low | repo:dependabot-npm |
Dependabot does not watch npm (package.json) | .github/dependabot.yml ecosystems: github-actions | Add a weekly npm entry targeting dev (owner decision: it opens PRs). |
| low | repo:dependabot-pip |
Dependabot does not watch pip (pyproject.toml) | .github/dependabot.yml ecosystems: github-actions | Add a weekly pip entry targeting dev (owner decision: it opens PRs). |
| low | url:https://github.com/AutodeskAILab/JoinABLe |
no push to AutodeskAILab/JoinABLe for over a year | last push 2022-04-22 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/ElmerCSC/elmerfem-docker |
no push to ElmerCSC/elmerfem-docker for over a year | last push 2021-03-09 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/Gary-code/CADReview |
no push to Gary-code/CADReview for over a year | last push 2025-08-08 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/Kamel773/CAD_Code_Generation |
no push to Kamel773/CAD_Code_Generation for over a year | last push 2025-02-28 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/Mechanical-Python/SnapFit_Calculator |
no push to Mechanical-Python/SnapFit_Calculator for over a year | last push 2022-03-16 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/SadilKhan/Text2CAD |
no push to SadilKhan/Text2CAD for over a year | last push 2025-05-15 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/anniedoris/CAD-Coder |
no push to anniedoris/CAD-Coder for over a year | last push 2025-07-17 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/artofscience/flexures |
no push to artofscience/flexures for over a year | last push 2023-11-06 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/buxtronix/living-hinge |
no push to buxtronix/living-hinge for over a year | last push 2024-05-31 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/calculix/beso |
no push to calculix/beso for over a year | last push 2025-04-03 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/dimitrismallis/CAD-Assistant |
no push to dimitrismallis/CAD-Assistant for over a year | last push 2025-10-30 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/dl4to/dl4to |
no push to dl4to/dl4to for over a year | last push 2024-11-19 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/kovacsv/occt-import-js |
no push to kovacsv/occt-import-js for over a year | last push 2024-12-03 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/lamaalrajih/kicad-mcp |
no push to lamaalrajih/kicad-mcp for over a year | last push 2025-10-17 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/missionlab/fenitop |
no push to missionlab/fenitop for over a year | last push 2024-11-01 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/nohkumado/openscad_snapfit |
no push to nohkumado/openscad_snapfit for over a year | last push 2021-11-01 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/secnot/rectpack |
no push to secnot/rectpack for over a year | last push 2021-11-24 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/sgsellan/swept-volumes |
no push to sgsellan/swept-volumes for over a year | last push 2024-07-18 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/skyneticist/flexure-hinge-calculator |
no push to skyneticist/flexure-hinge-calculator for over a year | last push 2025-06-08 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/tamasmeszaros/libnest2d |
no push to tamasmeszaros/libnest2d for over a year | last push 2024-05-03 | Check it is still maintained; if not, show it as "unmaintained". |
| low | webkit:occt-import-js |
no push to kovacsv/occt-import-js for over a year | last push 2024-12-03 | Check it is still maintained; if not, show it as "unmaintained". |
Info (9)
9 info: 8 link-unverified, 1 repo-unverified
| Severity | Subject | Finding | Evidence | Action |
|---|---|---|---|---|
| info | url:https://help.solidworks.com/2022/English/SolidWorks/sldworks/c_K_Factor.htm |
help.solidworks.com answered HTTP 403 | research/process-profiles.md:729 | Many sites refuse scripts; check by hand. |
| info | url:https://hull-repository.worktribe.com/output/4511720/interlayer-bonding-has-bulk-material-strength-in-extrusion-additive-manufacturing-new-understanding-of-anisotropy |
hull-repository.worktribe.com answered HTTP 403 | research/compliant-mechanisms.md:292 | Many sites refuse scripts; check by hand. |
| info | url:https://www.autodesk.com/products/fusion-360/blog/fusion-compute-mcp/ |
www.autodesk.com answered HTTP 403 |
research/agent-toolkits-2026-10.md:49 | Many sites refuse scripts; check by hand. |
| info | url:https://www.iso.org/standard/67289.html |
www.iso.org answered HTTP 403 |
research/process-profiles.md:733 | Many sites refuse scripts; check by hand. |
| info | url:https://www.iso.org/standard/7748.html |
www.iso.org answered HTTP 403 |
research/process-profiles.md:730 | Many sites refuse scripts; check by hand. |
| info | url:https://www.mouser.com/pdfDocs/Jetson_AGX_Orin_Series_TDG-10943-001_v11.pdf |
www.mouser.com did not answer |
The read operation timed out (research/simulation-tools.md:189) | Check by hand; run again later. |
| info | url:https://www.plasticstoday.com/plastics-processing/can-this-part-be-saved-part-3-living-hinges |
www.plasticstoday.com answered HTTP 403 |
research/compliant-mechanisms.md:335 | Many sites refuse scripts; check by hand. |
| info | url:https://xometry.pro/en/articles/fdm-design-tips/ |
xometry.pro answered HTTP 403 | research/process-profiles.md:670 | Many sites refuse scripts; check by hand. |
| info | url:https://github.com/pzfreo/cadgenbench-build123d |
pzfreo/cadgenbench-build123d could not be checked | Get "https://api.github.com/repos/pzfreo/cadgenbench-build123d": dial tcp 20.29.134.17:443: i/o timeout |
Run again later. |
Accepted (3)
3 read and accepted in research/security-accepted.yaml
| Severity | Subject | Finding | Evidence | Action |
|---|---|---|---|---|
| medium | npm:fsevents |
fsevents runs an install script (only on darwin) | node_modules/fsevents 2.3.2: hasInstallScript, optional | Read the script; in CI prefer npm ci --ignore-scripts where the package works without it. Accepted: Optional, macOS-only dependency of Playwright (os: darwin), so CI and Linux machines never install it. Read on 2026-11-01 (#151): the registry's manifest for 2.3.2 lists install "node-gyp rebuild" (gypfile), but the tarball the lockfile pins (its sha512 matches) has no binding.gyp and its package.json has no install script; it ships a prebuilt fsevents.node, so npm runs nothing at install. The fingerprint is 2.3.2's: when Playwright moves to another fsevents, the finding comes back to be read again. (2026-11-01) |
| medium | url:https://github.com/google/feabench |
google/feabench is archived (read-only, no fixes) | last push 2025-05-07 | Show it as "unmaintained" (status or note) instead of removing it; plan a replacement if we use its code. Accepted: Shown as archived where we name it: its catalogue card (research/landscape.json notes) and research/agent-toolkits-2026-10.md. Prior art only (it needs COMSOL); we use none of its code. (2026-11-01) |
| medium | url:https://github.com/microsoft/CADFusion |
microsoft/CADFusion is archived (read-only, no fixes) | last push 2026-07-02 | Show it as "unmaintained" (status or note) instead of removing it; plan a replacement if we use its code. Accepted: Shown as archived where we name it (research/design-workflows.md and design-workflows.json). Cited for its paper's results; ideas only, we use none of its code. (2026-11-01) |
What we depend on
22 Python packages (75 more pulled in), 22 npm packages, 6 vendored projects, 6 web kit folders, 419 links, 13 skills and agents
Python dependencies
| Extra | Direct | With transitive (deps.dev, newest releases) |
|---|---|---|
| required | 2 | 2 |
| cad | 6 | 45 |
| robot | 1 | 10 |
| sim | 10 | 41 |
| site | 1 | 1 |
| fea | 5 | 23 |
| explore | 1 | 11 |
| dev | 1 | 5 |
75 transitive packages (at the versions deps.dev resolves) were also checked against OSV; findings on them name the direct dependency they come through.
Table 22 rows: Package, Extras, Range, Newest, …
| Package | Extras | Range | Newest | Released | Licence | Lowest allowed | Advisories (newest / lowest) |
|---|---|---|---|---|---|---|---|
cadquery |
cad | >=2.8 | 2.8.0 | 2026-06-21 | Apache Public License 2.0 | 2.8.0 | 0 / 0 |
gmsh |
fea | >=4.11 | 4.15.2 | 2026-03-24 | GPLv2+ | 4.11.0 | 0 / 0 |
imageio |
sim | >=2.30 | 2.38.1 | 2026-10-08 | BSD-2-Clause | 2.30.0 | 0 / 0 |
imageio-ffmpeg |
sim | >=0.5 | 0.7.0 | 2026-10-28 | BSD-2-Clause | 0.5.0 | 0 / 0 |
manifold3d |
sim | >=2.4 | 3.5.4 | 2026-09-25 | Apache Software License | 2.4.5 | 0 / 0 |
markdown |
site | >=3.8.1 | 3.11.2 | 2026-10-19 | BSD-3-Clause | 3.8.1 | 0 / 0 |
matplotlib |
cad, fea, sim | >=3.7 | 3.11.2 | 2026-09-11 | Python Software Foundation License | 3.7.0 | 0 / 0 |
mujoco |
robot | >=3 | 3.17.0 | 2026-10-22 | Apache-2.0 | 3.0.0 | 0 / 0 |
numpy |
cad, required | >=1.22 | 2.5.4 | 2026-10-10 | BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0 | 1.22.0 | 0 / 0 |
optuna |
explore | >=3.4 | 5.0.0 | 2026-09-07 | MIT License | 3.4.0 | 0 / 0 |
pillow |
cad, sim | >=13.0 | 13.0.0 | 2026-10-16 | MIT-CMU | 13.0.0 | 0 / 0 |
pyamg |
fea | >=5 | 5.4.1 | 2026-10-30 | MIT License | 5.0.0 | 0 / 0 |
pymoto |
sim | >=2.0 | 2.0.1 | 2026-05-07 | MIT | 2.0.0 | 0 / 0 |
pypardiso |
fea | >=0.4 | 0.4.7 | 2025-11-02 | BSD-3-Clause | 0.4.0 | 0 / 0 |
pytest |
dev | >=9.0.3 | 9.2.0 | 2026-10-27 | MIT | 9.0.3 | 0 / 0 |
pyvista |
sim | >=0.44 | 0.49.2 | 2026-10-28 | MIT | 0.44.0 | 0 / 0 |
pyyaml |
required | >=6.0 | 6.0.3 | 2025-09-25 | MIT | 6.0 | 0 / 0 |
rtree |
sim | >=1.0 | 1.4.1 | 2025-08-13 | MIT | 1.0.0 | 0 / 0 |
scikit-fem |
fea | >=9 | 12.0.2 | 2026-06-05 | BSD License | 9.0.0 | 0 / 0 |
scipy |
sim | >=1.10 | 1.18.1 | 2026-08-21 | BSD License | 1.10.0 | 0 / 0 |
trimesh |
cad, sim | >=4.0 | 5.2.0 | 2026-10-24 | MIT License | 4.0.0 | 0 / 0 |
vtk |
cad | >=9.5.2 | 9.7.1 | 2026-09-28 | BSD | 9.5.2 | 0 / 0 |
npm (site build and browser tests)
4 direct, 22 packages in the lockfile including transitive.
Table 22 rows: Package, Version, Direct, Dev, …
| Package | Version | Direct | Dev | Licence | Install script | Advisories |
|---|---|---|---|---|---|---|
@playwright/test |
1.56.1 | yes | yes | Apache-2.0 | 0 | |
dayjs |
1.11.23 | yes | MIT | 0 | ||
dom-serializer |
3.1.1 | yes | MIT | 0 | ||
domelementtype |
3.0.0 | yes | BSD-2-Clause | 0 | ||
domhandler |
6.0.1 | yes | BSD-2-Clause | 0 | ||
domutils |
4.0.2 | yes | BSD-2-Clause | 0 | ||
entities |
8.1.0 | yes | BSD-2-Clause | 0 | ||
escape-string-regexp |
4.0.0 | yes | MIT | 0 | ||
fsevents |
2.3.2 | yes | MIT | yes | 0 | |
htmlparser2 |
12.0.0 | yes | MIT | 0 | ||
is-plain-object |
5.1.0 | yes | MIT | 0 | ||
launder |
1.7.2 | yes | MIT | 0 | ||
marked |
16.4.1 | yes | yes | MIT | 0 | |
nanoid |
3.3.20 | yes | MIT | 0 | ||
parse-srcset |
1.0.2 | yes | MIT | 0 | ||
picocolors |
1.1.1 | yes | ISC | 0 | ||
playwright |
1.56.1 | yes | Apache-2.0 | 0 | ||
playwright-core |
1.56.1 | yes | Apache-2.0 | 0 | ||
postcss |
8.5.32 | yes | MIT | 0 | ||
sanitize-html |
2.18.1 | yes | yes | MIT | 0 | |
source-map-js |
1.2.2 | yes | BSD-3-Clause | 0 | ||
yaml |
2.9.1 | yes | yes | ISC | 0 |
Vendored code (vendor/)
| Project | Pinned | Imported | Licence (manifest / file) | Files | Skills | Upstream | Behind | Scorecard | Drift |
|---|---|---|---|---|---|---|---|---|---|
| agentcad | 52af472ddade |
2026-10-24 | Apache-2.0 / Apache-2.0 | 234 | 0 | ok | 15 | 0 changed, 0 added, 0 missing (234 compared) | |
| bd_warehouse | e6ae6e7bae74 |
2026-10-24 | Apache-2.0 / Apache-2.0 | 123 | 0 | ok | 2 | 0 changed, 0 added, 0 missing (123 compared) | |
| build123d-mcp | 59b256121886 |
2026-10-24 | Apache-2.0 / Apache-2.0 | 175 | 4 | ok | 0 | 0 changed, 0 added, 0 missing (175 compared) | |
| kicad-happy | 2fd9aa0fe2d6 |
2026-10-24 | MIT / MIT | 213 | 11 | ok | 0 | 0 changed, 0 added, 0 missing (213 compared) | |
| kicad-mcp-pro | f03b478f597d |
2026-10-24 | MIT / MIT | 2088 | 30 | ok | 98 | 8.7 | 0 changed, 0 added, 0 missing (2088 compared) |
| text-to-cad | 2f793659fb7b |
2026-10-24 | MIT / MIT | 1864 | 13 | ok | 19 | 0 changed, 0 added, 0 missing (1864 compared) |
Web kit (src/cadagent/webkit/vendor/)
| Folder | Packages | Bundled inside | Files | Hashed | Matches its npm package | Newest | Advisories |
|---|---|---|---|---|---|---|---|
file-parsers |
[email protected], [email protected] | 5 | 5 | fflate: 2 of 2 | fflate 0.8.3, three 0.187.0 | 0 | |
fonts |
5 | 5 | 0 | ||||
linkedom |
[email protected] | 2 | 2 | linkedom 0.18.15 | 0 | ||
mermaid |
[email protected] | [email protected], [email protected] | 2 | 2 | mermaid: 2 of 2 | dompurify 3.4.17, katex 0.19.1, mermaid 12.2.0 | 6 |
occt-import-js |
[email protected] | 31 | 31 | occt-import-js 0.0.23 | 0 | ||
three |
[email protected] | 5 | 5 | three: 4 of 5 (1 patched) | three 0.187.0 | 0 |
Links we send people to
73 catalogue links (catalog.json, upstreams/registry.yaml, research/landscape.json) and 346 more in published pages; 29 have findings above.
Skills and agents
Table 13 rows: Item, Kind, Source, Version
| Item | Kind | Source | Version |
|---|---|---|---|
cad-pr-reviewer |
agent | this repository | 88ff87ffc253 |
cad-resume |
agent | this repository | 88ff87ffc253 |
cad-motion-validation |
skill | this repository | 88ff87ffc253 |
cad-pr-review |
skill | this repository | 88ff87ffc253 |
cad-remote-runs |
skill | this repository | 88ff87ffc253 |
cad-supply-chain |
skill | this repository | 88ff87ffc253 |
cad-work-tracking |
skill | this repository | 88ff87ffc253 |
design-process |
skill | this repository | 88ff87ffc253 |
mcmaster-parts |
skill | this repository | 88ff87ffc253 |
build123d-mcp |
4 vendored skills | https://github.com/pzfreo/build123d-mcp | 59b256121886 |
kicad-happy |
11 vendored skills | https://github.com/aklofas/kicad-happy | 2fd9aa0fe2d6 |
kicad-mcp-pro |
30 vendored skills | https://github.com/oaslananka/kicad-mcp-pro | f03b478f597d |
text-to-cad |
13 vendored skills | https://github.com/earthtojake/text-to-cad | 2f793659fb7b |
Sources
8 sources, with how each was reached
- deps.dev: api.deps.dev v3 dependency graphs (newest releases)
- github: GitHub REST API (gh)
- npm-audit: npm audit --package-lock-only
- npm-registry: registry.npmjs.org (abbreviated metadata)
- offline: pyproject.toml, package.json, package-lock.json, vendor/manifest.json, kit hash records, THIRD_PARTY_NOTICES.md, upstreams/registry.yaml, research/landscape.json, published Markdown
- osv: osv.dev querybatch and vulns
- pypi: pypi.org JSON API
- scorecard: api.securityscorecards.dev