efecto-graphic-design
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs the user to fetch the
@efectoapp/mcppackage from the public npm registry to enable interaction with the design canvas.\n- [REMOTE_CODE_EXECUTION]: Uses thenpxcommand to download and run the Efecto MCP server at runtime, a standard integration method for Node.js-based MCP tools.\n- [COMMAND_EXECUTION]: Provides specific shell commands and configuration snippets for various clients (Claude Code, Cursor, Windsurf) to automate the installation and execution of the MCP server.\n- [DATA_EXFILTRATION]: Facilitates communication with theefecto.appdesign platform to manage real-time design sessions and synchronize document states.\n- [PROMPT_INJECTION]: The skill processes document metadata and canvas state via tools likeget_documentandget_node_tree(SKILL.md), which represents a surface for indirect prompt injection as this data is editable via a browser interface.\n - Ingestion points:
get_document,get_node_tree,get_selection\n - Boundary markers: Absent\n
- Capability inventory: 46 graphic design manipulation tools including
add_nodeandbatch_update\n - Sanitization: None mentioned
Audit Metadata