lightcraft-batch-photo-style
Warn
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a portable executable (
lightcraft-cli.exe) from thestorytold/lightcraftGitHub repository, and references build artifacts and documentation onpartme-ai,dpnkrpl, anddarktable-orgrepositories (references/craft-command-evidence.json,references/workflow-sources.json). - [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute the LightCraft binary to perform photo processing tasks such as setting develop values and exporting images (
SKILL.md,references/craft-command-evidence.json). - [COMMAND_EXECUTION]: The skill utilizes shell commands and the
command_runtool to interact with the local filesystem for importing images, processing them via the CLI, and exporting results to specified directories (references/craft-methods.md). - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for instructions embedded in the data it processes.
- Ingestion points: Retrieves photo metadata and settings via
catalog.queryanddevelop.get(references/craft-steps.json). - Boundary markers: Absent; no delimiting or 'ignore' instructions are provided for the photo data content.
- Capability inventory: The skill can execute shell commands, perform file system writes, and modify application state via
command_run(SKILL.md). - Sanitization: Absent; no validation or filtering of photo metadata is performed before use.
- [SAFE]: The skill follows security best practices by providing a SHA256 checksum (
57f3e65fccd33abf2f37d67532662ca55235287f5b41e5bb9bc057da4485caa9) to verify the integrity of the downloaded LightCraft binary (references/craft-command-evidence.json).
Audit Metadata