effectcraft-cli-tracking
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill automates the download and installation of the EffectCraft CLI, desktop binary, and specialized model weights (e.g., for face tracking and rotoscoping). These resources are fetched from official vendor repositories and verified against pinned SHA-256 hashes to ensure they have not been tampered with.
- [DYNAMIC_EXECUTION]: The skill includes tools such as
run_scriptandfile.runScriptthat allow for the execution of JavaScript and scripting files within the EffectCraft environment. This is a legitimate and standard feature for creative software automation (similar to After Effects ExtendScript) and is used here to enable advanced project manipulation. - [COMMAND_EXECUTION]: High-level orchestration is managed through specialized launcher scripts (
launch.shandlaunch.ps1) that prepare isolated environments, manage task lifecycles, and execute CLI commands while preventing global system modifications. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data including video footage, project files (
.ecproj), and JSON command plans. Although this presents a theoretical surface for indirect prompt injection, the risk is minimized by the skill's implementation of strict JSON schema validation, monotonic clock-based locks, and the specialized, non-textual nature of the creative data being processed.
Audit Metadata