motion-craft
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands using
npx remotion renderandffmpegto generate video and extract frames for manual verification. These commands are standard in the motion design domain and are used here for legitimate quality assurance purposes without exposure to untrusted inputs. - [INDIRECT_PROMPT_INJECTION]: The skill establishes a "Verification loop" that processes rendered output using
ffmpeg. This creates a processing surface for generated data during a sequence of automated steps. However, as no network exfiltration or sensitive file access is involved in these operations, the risk is minimal. - Ingestion points:
SKILL.md(via command-line execution ofnpx remotion renderandffmpegtargeting project source files). - Boundary markers: Not applicable in the context of the provided shell command templates.
- Capability inventory:
npm install,npx remotion render,ffmpeg(as specified in the rendering and verification instructions). - Sanitization: Not present in the command templates, but risks are mitigated by the deterministic nature of the rendering process.
Audit Metadata