artcraft-cli
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads machine learning models (such as Whisper) from Hugging Face for speech-to-text operations. These downloads use specific commit hashes to ensure the integrity of the downloaded content.
- [COMMAND_EXECUTION]: The skill executes Python orchestration scripts (e.g.,
bootstrap.py,workflow.py,cli.py) provided by theartcraft-harnessharness skill to manage runtimes and native CLI tools. - [COMMAND_EXECUTION]: The skill uses the
npx skills addcommand to dynamically install or update domain-specific sibling skills (e.g.,vectorcraft-skills,photocraft-skills) from the vendor's official repository. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied JSON workflow plans and various media assets (WAV, PNG, etc.). It mitigates injection risks by using 'frozen plans' that are hashed upon initialization and by strictly validating artifact digests before processing data at each step of the DAG (Directed Acyclic Graph).
Audit Metadata