lightcraft-cli-develop
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
bootstrap.pyscript downloads official CLI binaries from GitHub releases associated with the developer organizationsstorytoldandfull-aigc-skills. This process utilizes a well-known service (GitHub) to fetch vendor-affiliated resources. - [REMOTE_CODE_EXECUTION]: The skill manages its own native dependencies by installing and executing a CLI tool. Security is maintained through mandatory SHA256 integrity verification of the downloaded packages and the extracted binaries before any code is run.
- [COMMAND_EXECUTION]: Native commands are executed via the
subprocessmodule. The skill restricts execution to a specific set of allowed subcommands (e.g., render, snapshot, run) and uses a supervisor script to enforce timeouts and log output safely. - [INDIRECT_PROMPT_INJECTION]: The skill handles potentially untrusted data from image files and JSON plans. It implements multiple defensive layers, including strict JSON schema validation for plans, file-level integrity checks (SHA256), and path validation to prevent operations outside the intended output directory.
Audit Metadata