motion-craft

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands using npx remotion render and ffmpeg to generate video and extract frames for manual verification. These commands are standard in the motion design domain and are used here for legitimate quality assurance purposes without exposure to untrusted inputs.
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes a "Verification loop" that processes rendered output using ffmpeg. This creates a processing surface for generated data during a sequence of automated steps. However, as no network exfiltration or sensitive file access is involved in these operations, the risk is minimal.
  • Ingestion points: SKILL.md (via command-line execution of npx remotion render and ffmpeg targeting project source files).
  • Boundary markers: Not applicable in the context of the provided shell command templates.
  • Capability inventory: npm install, npx remotion render, ffmpeg (as specified in the rendering and verification instructions).
  • Sanitization: Not present in the command templates, but risks are mitigated by the deterministic nature of the rendering process.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 01:44 PM