vectorcraft-editable-chart

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the run_command tool and the vectorcraft-cli executable to perform graphic editing tasks such as creating graphs, setting types, and modifying data.
  • [EXTERNAL_DOWNLOADS]: The skill includes metadata referencing a portable Windows runtime for the Vectorcraft tool hosted on a GitHub repository (references/craft-command-evidence.json). Additionally, it provides instructions for installing a related skill using npx from the same author's namespace (full-aigc-skills/vectorcraft-skills).
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied "material" to generate reports and charts, which presents a surface for indirect prompt injection attacks.
  • Ingestion points: The skill reads external material to determine delivery use, dimensions, and modification ranges as described in SKILL.md.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the ingested materials are provided.
  • Capability inventory: The skill has access to run_command, draw_shape, and save_file tools across its scripts, allowing for file system modifications and CLI interactions.
  • Sanitization: The skill lacks specified sanitization or validation logic for the content extracted from external materials before passing them to the rendering engine.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 12:11 PM