effectcraft-cli-puppet
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill facilitates advanced media automation through the
run_scriptcommand, which allows the execution of JavaScript within the engine's object model (After Effects-style API), and theprop.setExpressioncommand for defining dynamic animation properties. - [COMMAND_EXECUTION]: The skill delegates operational tasks to the
effectcraft-harnessskill, usinglaunch.sh(POSIX) andlaunch.ps1(Windows) to manage CLI processes. It emphasizes path isolation and the use of an internal state root to prevent global system modifications. - [INDIRECT_PROMPT_INJECTION]: As a tool that processes external media and user-defined JSON plans, the skill maintains a surface for indirect prompt injection. This risk is addressed through strict JSON schema validation, the use of unique keys, and isolation of the runtime environment.
- [EXTERNAL_DOWNLOADS]: The skill includes functionality for downloading official model weights (e.g.,
face.model.download,roto.model.download) and binaries. These downloads are described as fetching from official sources and are verified against SHA-256 hashes defined in the skill's locks.
Audit Metadata