photocraft-cli-retouch
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts including bootstrap.py, cli.py, and workflow.py to manage the installation and operation of the photo retouching CLI. These executions are intended for environment setup and command routing.
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs a pinned version of the PhotoCraft CLI binary. The documentation describes a process for verifying these binaries against official SHA-256 hashes and signatures to ensure authenticity and integrity before execution.
- [DYNAMIC_EXECUTION]: The skill identifies the location of its execution scripts at runtime using the HARNESS_DIR environment variable. This allows the skill to dynamically load and run logic from a sister skill (photocraft-harness) provided by the same vendor.
- [INDIRECT_PROMPT_INJECTION]: The skill processes complex JSON-based edit plans that define image operations. This creates an attack surface for indirect injection via data. The skill mitigates this risk by enforcing strict JSON validation, unique key checks, and explicit whitelisting of allowed commands.
Audit Metadata