vectorcraft-cli-assets
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external vector assets including SVG, PDF, and raster images, as well as JSON-based operation plans. These represent ingestion points for untrusted data. The skill implements boundary markers via structured JSON schemas and uses a kernel-level filesystem policy to restrict the impact of processed data.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download and installation of a specific version of the VectorCraft CLI and desktop application. The installation process includes verification of artifact integrity through SHA-256 digest checks to prevent the execution of corrupted or malicious binaries.
- [COMMAND_EXECUTION]: Instructions guide the agent to execute a suite of Python scripts provided by the vectorcraft-harness skill from the same author. These scripts are used to orchestrate the lifecycle of the vector manipulation environment and execute CLI commands for document creation, editing, and export.
Audit Metadata