vectorcraft-cli-appearance
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs self-installation of its required CLI binary and harness scripts. It uses a bootstrap script to download the VectorCraft CLI and utilizes the
npx skills addcommand to fetch the vectorcraft-harness from the author's GitHub repository (full-aigc-skills/vectorcraft-skills). These are standard setup procedures for the skill's functionality. - [COMMAND_EXECUTION]: The skill's primary function involves executing local CLI commands to manipulate vector design files. These executions are managed by Python scripts that control the command environment and enforce kernel-level filesystem policies on macOS to prevent unauthorized file access.
- [INDIRECT_PROMPT_INJECTION]: Because the skill processes external graphic files (such as SVG, PDF, and .vectorcraft projects), it has an inherent surface for processing untrusted data. It mitigates this risk by requiring explicit SHA-256 integrity hashes for source projects before any editing operations are performed, ensuring that the agent only operates on verified content.
Audit Metadata