designcraft-long-document
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references a specific, versioned binary of the DesignCraft CLI (v0.8.0) hosted on GitHub Releases. This reference in
references/craft-command-evidence.jsonincludes a SHA256 checksum for integrity verification, following security best practices. - [COMMAND_EXECUTION]: The skill utilizes a local Python utility (
scripts/write_script.py) to compile layout recipes into structured command sequences. It also instructs the user on how to install related skills using thenpx skills addplatform command. - [DYNAMIC_EXECUTION]: The provided Python script performs runtime resolution of cross-references within JSON templates to generate the final execution plan for the DesignCraft CLI. This is a localized, deterministic transformation of static data.
- [INDIRECT_PROMPT_INJECTION]: The skill processes document content and headings. It mitigates the risk of instructions embedded in the document text by enforcing a style-based selection logic (targeting paragraph styles rather than raw text matching) and requiring the agent to perform structural verification of the final output.
Audit Metadata