effectcraft-kinetic-type
Warn
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documents a download location for a portable ZIP archive containing an executable (
effectcraft-cli.exe) from a third-party repository (github.com/storytold). - [EXTERNAL_DOWNLOADS]: The skill references an external API endpoint (
api.skillhub.cn) for downloading motion graphics assets. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled text to generate animations through the
layer.newTextcommand, creating a surface for indirect instructions. - Ingestion points: User-supplied text strings are interpolated into the
textparameter of animation tool calls inSKILL.mdandreferences/craft-methods.md. - Boundary markers: The instructions do not define delimiters or provide warnings to the agent to ignore potential instructions embedded within the text content.
- Capability inventory: The skill possesses the ability to execute engine commands via
command_run, write project files usingsave_project, and inspect output withinspectacross multiple scripts. - Sanitization: No sanitization, escaping, or validation logic is defined to process the input text before it enters the tool execution pipeline.
- [DYNAMIC_EXECUTION]: Employs dynamic command construction for the
effectcraft-clitool andcommand_runinterface, where parameters are mapped from templates at runtime.
Audit Metadata