anatomy-reveal

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocesses to coordinate its build and rendering pipeline. It executes standard tools like npm for dependency management, ffmpeg for video encoding, and magick for image processing. It also runs internal Node.js scripts to generate project files and perform rendering calculations.
  • [INDIRECT_PROMPT_INJECTION]: The skill workflow involves researching object specifications from external sources and using that information to generate geometric code. While this creates a surface for indirect prompt injection, the instructions mitigate this risk by directing the agent to rebuild shapes mathematically rather than directly embedding external data.
  • [DYNAMIC_EXECUTION]: The skill generates and executes dynamic content as part of its rendering engine. The agent produces JavaScript geometry code which is bundled into HTML/JS pages and executed within a Puppeteer-controlled browser instance to capture frames and generate the final output.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 01:30 PM