hand-drawn-canvas-animation
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided descriptions to generate animation code, creating a surface for potential indirect injection.
- Ingestion points: User descriptions are used to author the HTML and JavaScript for films (e.g.,
my-film.html). - Boundary markers: Not explicitly defined in the provided scripts; the system relies on the agent's safe code generation.
- Capability inventory: The rendering pipeline in
scripts/render.mjsandscripts/photo.mjsusesexecFileSyncto interact withffmpeg,ffprobe, andrembg. It also usespuppeteer-coreto drive a local browser. - Sanitization: Relies on the AI agent's internal safety protocols during the code-generation phase.
- [COMMAND_EXECUTION]: Local media processing and utility tools are executed as part of the asset preparation and rendering workflow.
- Evidence:
scripts/render.mjs,scripts/photo.mjs, andscripts/verify.mjsinvokeffmpeg,ffprobe, andrembgvia Node.jschild_process.execFileSyncto process imagery and encode video. - [EXTERNAL_DOWNLOADS]: The skill documentation encourages sourcing media assets from reputable cultural and academic institutions.
- Evidence: Guides like
references/doodle.mdsuggest downloading assets from the Metropolitan Museum of Art and Wikimedia Commons for creative work.
Audit Metadata