Codex, Plugin
Solidworks Gpt Plugin
Knowledge-backed SolidWorks design and validation plugin for OpenAI Codex
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 14e1722a7491, unchanged since the check below.
NETWORK_NO_FIXED_HOST PERMISSION_SHELL_DECLARED
Why this grade
- NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
plugins/solidworks-gpt-plugin/scripts/doctor.py, line 157
"curl is available for consent-based feedback submission", - PERMISSION_SHELL_DECLARED Note
Runs shell commands, and the manifest or description says so.
plugins/solidworks-gpt-plugin/scripts/run_checks.py, line 144
result = subprocess.run(
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
plugins/solidworks-gpt-plugin/scripts/run_checks.py, line 144
result = subprocess.run(
plugins/solidworks-gpt-plugin/scripts/submit_feedback.py, line 93
completed = subprocess.run(
scripts/validate_installed_bundle.py, line 30
subprocess.run([sys.executable, str(runner)], check=True)
Show more
plugins/solidworks-gpt-plugin/docs/CODEX-SOLIDWORKS-PLUGIN-SPEC.md, line 432
r = subprocess.run(["curl", "-s", "-w", "\n%{http_code}", "-X", "POST",
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
plugins/solidworks-gpt-plugin/scripts/doctor.py, line 157
"curl is available for consent-based feedback submission",
plugins/solidworks-gpt-plugin/scripts/doctor.py, line 164
"curl is unavailable; CAD workflows still work, but feedback submission does not",
plugins/solidworks-gpt-plugin/scripts/doctor.py, line 283
help="Require curl and a registered SolidWorks installation.",
Show more
plugins/solidworks-gpt-plugin/scripts/submit_feedback.py, line 2
"""Submit a validated FeedbackSubmission with bounded curl retries."""
plugins/solidworks-gpt-plugin/scripts/submit_feedback.py, line 80
curl = shutil.which("curl")
plugins/solidworks-gpt-plugin/scripts/submit_feedback.py, line 82
raise OSError("curl is not available")
plugins/solidworks-gpt-plugin/scripts/submit_feedback.py, line 83
# Hand curl UTF-8 bytes ourselves. In text mode subprocess would encode
plugins/solidworks-gpt-plugin/skills/sw-kb-api/SKILL.md, line 21
curl -sS "{KB_HOST}/health"
Secrets
Pass
No read of a credential file or secret environment variable found.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 14e1722a7491. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address.
Date and source
Date checked:
github.com
Commit graded: 14e1722a7491e548333488e2eba9d29d3c9f707e
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.