vectorcraft-cli-shapes
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches and installs the VectorCraft CLI and desktop runtimes from the author's repository ('full-aigc-skills/vectorcraft-skills') with integrity verification performed via 'runtime.lock.json'.
- [COMMAND_EXECUTION]: The skill invokes management scripts such as 'bootstrap.py' and 'workflow.py' to configure the environment and execute vector design operations.
- [INDIRECT_PROMPT_INJECTION]: The skill maintains an attack surface for indirect prompt injection. 1. Ingestion points: User-provided JSON plans and external assets (SVG, PNG, PDF) are ingested by the harness scripts as described in 'SKILL.md' and 'references/workflow.md'. 2. Boundary markers: Employs 'expectedProjectSha256' for source project verification and enforces JSON schema validation. 3. Capability inventory: Includes file system writes for exporting projects, subprocess execution of the CLI tool, and network access for initial setup. 4. Sanitization: Implements JSON structure validation and manifest-based integrity checks.
Audit Metadata