Skills Explorer Add Skills

step-parts

An agent skill by earthtojake, from earthtojake/text-to-cad. Tags: api, automation, design, research, web.

What it does

Find, evaluate, and download common purchasable CAD parts from step.parts, including named off-the-shelf actuators, servos, motors, electronics boards, connectors, screws, bolts, nuts, washers, bearings, standoffs, and other catalog components. Use when Codex needs to search the hosted step.parts catalog before creating simplified placeholder geometry, resolve fuzzy part names, standards, aliases, or dimensions, choose a matching part, fetch a canonical .step file, verify checksums, or use the step.parts API/OpenAPI/catalog endpoints for standard part discovery.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add earthtojake/text-to-cad --skill step-parts

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/earthtojake/text-to-cad
cp -r text-to-cad/skills/step-parts ~/.claude/skills/step-parts

Safety box score

Grade C, moderate risk: 26 of 100 risk points, rated 2026-10-21. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill queries the public step.parts catalog and can download canonical STEP files using a bundled Python helper. The main risks are ordinary but real network access to a third-party service and local file writes/overwrites; it does not appear to request secrets, sudo, or account access.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution2 (moderate)The shipped helper `scripts/download_step_part.py` is an executable Python downloader that runs HTTP requests and writes files when invoked, e.g. `python scripts/download_step_part.py ... --download` and `urllib.request.urlopen(...)`.
Network access2 (moderate)It contacts the external `https://api.step.parts` API and downloads STEP bytes from returned `stepUrl` values; the skill also allows overriding the origin with `--origin`.
Filesystem reach2 (moderate)The downloader writes STEP files to a chosen `--out-dir` (defaulting to the temp directory) and can replace existing files with `--overwrite`, so it can modify local paths outside the project if pointed there.
Secrets & credentials0 (none)No code or instructions access tokens, passwords, key files, browser sessions, or `.env` secrets.
Privilege & persistence0 (none)There is no sudo, service registration, global install, shell startup editing, or other privileged system change.
Instruction hijack surface1 (low)The skill contains operational directives to the agent, such as treating `https://api.step.parts` as canonical and retrying network access before reporting a miss; this is instruction-shaping, though not a hidden or malicious prompt injection.
Irreversible actions0 (none)It can search and download parts, but it does not push, publish, pay, book, send messages, or delete remote resources.
Transparency0 (none)All shipped files are plain text and readable; there are no binaries, minified blobs, or decoded-at-runtime payloads.

Before installing

Rated 2026-10-21 by an automated review of 4 files from the skill's repository.

Source

Repository
earthtojake/text-to-cad (all skills from this repository)
Path
skills/step-parts/SKILL.md
Branch
main
Updated
2026-09-19