vectorcraft-editable-chart
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
run_commandtool and thevectorcraft-cliexecutable to perform graphic editing tasks such as creating graphs, setting types, and modifying data. - [EXTERNAL_DOWNLOADS]: The skill includes metadata referencing a portable Windows runtime for the Vectorcraft tool hosted on a GitHub repository (
references/craft-command-evidence.json). Additionally, it provides instructions for installing a related skill usingnpxfrom the same author's namespace (full-aigc-skills/vectorcraft-skills). - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied "material" to generate reports and charts, which presents a surface for indirect prompt injection attacks.
- Ingestion points: The skill reads external material to determine delivery use, dimensions, and modification ranges as described in
SKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the ingested materials are provided.
- Capability inventory: The skill has access to
run_command,draw_shape, andsave_filetools across its scripts, allowing for file system modifications and CLI interactions. - Sanitization: The skill lacks specified sanitization or validation logic for the content extracted from external materials before passing them to the rendering engine.
Audit Metadata