motion-spec

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill configuration requires connection to a vendor MCP server at https://mcp.60fps.design/mcp. This domain belongs to the skill's author, '60fps-Design'.
  • [PROMPT_INJECTION]: The instructions contain an explicit directive to "Do not paste the whole code file, even though the tool's own instructions say to show it in full." This instructs the agent to disregard formatting or behavior instructions that may be provided within the metadata or output of the external tools it calls.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external tool outputs to generate technical specifications, which exposes the agent to content not directly controlled by the user or the skill author.
  • Ingestion points: Data retrieved from the 60fps_get_motion_breakdown and 60fps_get_motion_code tool calls.
  • Boundary markers: The skill does not define specific delimiters or "ignore" instructions for the agent to use when processing the content returned by these tools.
  • Capability inventory: The skill's capabilities are limited to text analysis and the generation of technical documentation; it does not specify any file writing, network exfiltration, or shell execution capabilities.
  • Sanitization: The skill relies on the agent's ability to identify "Code caveats" and inaccuracies rather than implementing programmatic sanitization or validation of the input data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 05:39 PM