efecto-graphic-design

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill directs the user to fetch the @efectoapp/mcp package from the public npm registry to enable interaction with the design canvas.\n- [REMOTE_CODE_EXECUTION]: Uses the npx command to download and run the Efecto MCP server at runtime, a standard integration method for Node.js-based MCP tools.\n- [COMMAND_EXECUTION]: Provides specific shell commands and configuration snippets for various clients (Claude Code, Cursor, Windsurf) to automate the installation and execution of the MCP server.\n- [DATA_EXFILTRATION]: Facilitates communication with the efecto.app design platform to manage real-time design sessions and synchronize document states.\n- [PROMPT_INJECTION]: The skill processes document metadata and canvas state via tools like get_document and get_node_tree (SKILL.md), which represents a surface for indirect prompt injection as this data is editable via a browser interface.\n
  • Ingestion points: get_document, get_node_tree, get_selection\n
  • Boundary markers: Absent\n
  • Capability inventory: 46 graphic design manipulation tools including add_node and batch_update\n
  • Sanitization: None mentioned
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 01:28 PM