effectcraft-cli-project

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes complex data including JSON plans and creative project files (.ecproj) which serve as ingestion points for external content. This creates a surface for indirect instructions to be processed by the agent. The skill instructions prioritize checking project summaries and requiring user confirmation for critical changes as a mitigation strategy.
  • Ingestion points: Creative project files (.ecproj), asset imports, and JSON-based operation plans.
  • Boundary markers: Mentions verification steps and project summaries, though specific prompt-level delimiters for data interpolation are not detailed.
  • Capability inventory: File writing, CLI command execution, script execution (JavaScript), and media rendering.
  • Sanitization: Relies on the EffectCraft engine's internal handling of project data.
  • [DYNAMIC_EXECUTION]: The skill facilitates creative scripting through the run_script tool, which executes JavaScript, and the prop.setExpression command, which applies expressions to properties. This dynamic behavior is a core feature of the supported creative engine.
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install its required execution harness (effectcraft-harness) from the vendor's repository. This follows the platform's standard procedure for managing cross-skill dependencies.
  • [COMMAND_EXECUTION]: The skill executes various orchestration scripts (Python and shell) provided by the vendor to manage the environment and execute the underlying CLI tool. These scripts are invoked from the harness skill's directory.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 01:29 PM