hand-drawn-canvas-animation

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided descriptions to generate animation code, creating a surface for potential indirect injection.
  • Ingestion points: User descriptions are used to author the HTML and JavaScript for films (e.g., my-film.html).
  • Boundary markers: Not explicitly defined in the provided scripts; the system relies on the agent's safe code generation.
  • Capability inventory: The rendering pipeline in scripts/render.mjs and scripts/photo.mjs uses execFileSync to interact with ffmpeg, ffprobe, and rembg. It also uses puppeteer-core to drive a local browser.
  • Sanitization: Relies on the AI agent's internal safety protocols during the code-generation phase.
  • [COMMAND_EXECUTION]: Local media processing and utility tools are executed as part of the asset preparation and rendering workflow.
  • Evidence: scripts/render.mjs, scripts/photo.mjs, and scripts/verify.mjs invoke ffmpeg, ffprobe, and rembg via Node.js child_process.execFileSync to process imagery and encode video.
  • [EXTERNAL_DOWNLOADS]: The skill documentation encourages sourcing media assets from reputable cultural and academic institutions.
  • Evidence: Guides like references/doodle.md suggest downloading assets from the Metropolitan Museum of Art and Wikimedia Commons for creative work.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 04:46 PM
Security Audit — agent-trust-hub — hand-drawn-canvas-animation