kinetograph-migrate
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to execute various CLI commands using
npx kinetograph, includingdoctor,lint,render, andcompositions, which are necessary for analyzing and processing the project code. - [EXTERNAL_DOWNLOADS]: The instructions guide the user to install the
kinetographpackage and the@kinetographdev/skiaaddon from the npm registry. - [INDIRECT_PROMPT_INJECTION]: Because the skill involves analyzing external project files such as source code and configuration files, it presents an attack surface where malicious instructions embedded in those files could attempt to influence the agent's behavior.
- Ingestion points:
package.json,remotion.config.ts, and various project source files (.ts,.tsx,.js). - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified for the file-reading operations.
- Capability inventory: The agent is authorized to read local files and execute CLI-based shell commands.
- Sanitization: There is no mention of sanitizing or validating the content of the ingested code files.
Audit Metadata