lightcraft-photo-culling
Warn
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references a portable ZIP archive containing an executable (‘lightcraft-cli.exe’) hosted on a GitHub repository (‘storytold/lightcraft’). While a SHA256 hash is provided for integrity checking, downloading and executing binaries from non-whitelisted sources carries inherent risks.
- [REMOTE_CODE_EXECUTION]: Instructions guide the user to install an additional skill package (‘lightcraft-editor’) from the ‘full-aigc-skills’ organization using the platform’s skill installation command (‘npx skills add’).
- [COMMAND_EXECUTION]: The workflow relies on executing shell commands via the ‘lightcraft-cli’ and a ‘command_run’ interface to perform photo library queries and metadata operations.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external image files and their associated metadata during the culling and rating process. Although the skill includes instructions to preserve original data and check results against user goals, malicious instructions embedded in photo metadata could potentially influence the agent's logic or decision-making during the task.
Audit Metadata