effectcraft-cli-footage
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell scripts (
launch.shandlaunch.ps1) to coordinate its internal harness and manage the execution of creative tasks without modifying global system paths. - [EXTERNAL_DOWNLOADS]: Downloads official machine learning model weights for features like Face Tracking and Roto Brush from vendor-managed sources using system tools like
curl. - [DYNAMIC_EXECUTION]: Includes a
run_scriptfunctionality that enables the execution of JavaScript code within a specialized scripting model for After Effects-style automation, which is standard for high-end creative workflows. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it processes complex external data formats such as PSD, SVG, and video footage.
- Ingestion points: Untrusted data enters the context via
mediaBrowser.importandfile.importtools as documented inreferences/scenario.mdandnative-command-snapshot.json. - Boundary markers: The
managed-execution.mddocumentation provides explicit warnings against passing raw natural language as native parameters. - Capability inventory: The skill possesses capabilities for native command execution and JavaScript scripting within the engine.
- Sanitization: Creative tasks are structured as JSON plans and are subjected to strict schema validation (
craft-command-plan/v1) and integrity checks before execution.
Audit Metadata