photocraft-cli-selection

SUSPICIOUS: the editing capabilities match the stated PhotoCraft purpose, and data flow stays local to PhotoCraft/loopback workflows, but the skill’s real execution depends on installing and trusting a separate harness skill whose code is absent here. That transitive installation model is the main risk; the command-injection findings appear to be documentation false positives, not active exploit behavior.