photocraft-cli
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a bootstrap mechanism to install a specific PhotoCraft CLI version. This installation is managed by the photocraft-harness script (from the same vendor) and targets local user-data directories, which is consistent with its primary function.
- [SAFE]: No patterns of malicious obfuscation, credential theft, or unauthorized persistence were identified. Hardcoded SHA-256 hashes are used legitimately for binary and project integrity verification.
- [SAFE]: The skill enforces project-level security by validating expected hashes before performing revisions, preventing unauthorized modification of source materials.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external media assets and project files (.pcraft), which are potential ingestion points for indirect prompt injection. However, the risk is mitigated by the use of strictly structured JSON plans, input validation scripts, and clear boundary markers in the documentation. The severity is categorized as low given the specialized nature of the creative tool and the presence of integrity checks.
Audit Metadata