effectcraft-cli-camera
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses a
bootstrap.pyscript to download and install a pinned version of the EffectCraft CLI into a user-specified runtime directory. This process is managed by the vendor's harness and includes SHA-256 integrity verification of all downloaded artifacts. - [COMMAND_EXECUTION]: The skill initiates shell commands (e.g., via
launch.shorlaunch.ps1) and Python scripts to execute 3D rendering workflows and command plans. These operations are scoped to the user's project and output directories. - [DYNAMIC_EXECUTION]: The engine includes a
run_scriptcapability that allows the execution of JavaScript code within an After Effects-style scripting object model. This is an intended feature for automating complex 3D engine tasks and is managed through the skill's command interface. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of user-supplied assets, project files, and task confirmation inputs. It mitigates this risk by using strict JSON schema validation for plans and performing checksum verification on project files to ensure consistency between creation and revision steps.
Audit Metadata