machine
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Node.js scripts (
record.mjs,shot.mjs,inline.mjs) to automate the production of 3D simulations and media artifacts. These scripts leverage system utilities like FFmpeg for video processing and Playwright for browser-based rendering. - [EXTERNAL_DOWNLOADS]: Retrieves the Three.js library and associated modules from the jsDelivr CDN, environmental textures from Poly Haven, and audio tracks from Archive.org. These sources are established and well-known service providers in the developer community.
- [DYNAMIC_EXECUTION]: Utilizes
eval()within the browser context during the review phase (shot.mjs) to programmatically manipulate the simulation state, such as toggling cutaways or camera positions, based on agent-generated logic. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user descriptions via the
/machinecommand. The generation process is guided by a rigorous engineering workflow involving research and physics modeling, which inherently scopes the agent's behavior and reduces the impact of adversarial instructions.
Audit Metadata