effectcraft-cli-effects
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill provides advanced capabilities for executing arbitrary JavaScript code via the
run_scripttool and loading WebAssembly plugins through theeffect.plugins.loadcommand, both of which operate within the video engine's scripting environment. - [COMMAND_EXECUTION]: The skill relies on executing various shell and Python scripts, such as
launch.shandbootstrap.py, to manage the EffectCraft CLI lifecycle and coordinate desktop sessions. - [EXTERNAL_DOWNLOADS]: The skill automates the download and installation of CLI and desktop binaries. It follows security best practices by pinning versions and enforcing SHA-256 integrity checks on the downloaded artifacts.
- [INDIRECT_PROMPT_INJECTION]: The skill processes complex JSON creative plans, which represent a potential entry point for indirect prompt injection from untrusted data sources. This risk is addressed through pre-execution schema validation and duplicate key checks.
Audit Metadata