artcraft-cli-revise
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were detected in the skill's instructions, scripts, or examples.
- [EXTERNAL_DOWNLOADS]: The skill downloads machine learning models (Whisper) from Hugging Face and references code on GitHub. Both are well-known technology services and are treated as safe sources for these resources.
- [COMMAND_EXECUTION]: The skill executes local Python scripts (e.g.,
bootstrap.py,workflow.py) using the-I -Bflags, which ensures isolated execution by ignoring environment variables and preventing the creation of bytecode files. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill handles sensitive orchestration data like authorization tokens and budgets, but it does so via structured JSON parameters passed to local scripts. No evidence of data exfiltration to untrusted domains was found.
- [INDIRECT_PROMPT_INJECTION]: While the skill ingests external data (assets, JSON plans), it utilizes strict SHA-256 digest verification for all components of the workflow, significantly mitigating the risk of processing unauthorized or tampered content.
Audit Metadata