photocraft-cli-masks
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill initiates image processing by executing Python scripts, such as workflow.py and cli.py, which are located in the companion photocraft-harness skill directory.
- [EXTERNAL_DOWNLOADS]: The skill includes instructions to download and install locked versions of the PhotoCraft CLI and desktop application for macOS arm64, ensuring the editing environment is correctly provisioned using vendor-managed resources.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of user-provided image assets and JSON command plans. To mitigate this risk, it implements structured plan validation via a pre-execution check command and enforces project integrity using expected SHA-256 hashes for source files.
- [SAFE]: Analysis of the skill's operations and dependency management reveals no signs of malicious intent, credential theft, or unauthorized data exfiltration; all external operations are tied to the verified full-aigc-skills ecosystem.
Audit Metadata