skills/authrain-cloud-abdullahformuli/explainer-video-skills/isometric-animation/Gen Agent Trust Hub
isometric-animation
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute specific shell scripts (
scripts/seek-shot.sh,scripts/contact-sheet.sh) and external tools likenpx playwrightto verify animation frames and create contact sheets for visual review. - [EXTERNAL_DOWNLOADS]: The skill fetches the
GSAPandThree.jslibraries from thejsdelivr.netCDN. These are well-known services used for hosting common web assets. - [INDIRECT_PROMPT_INJECTION]: The skill incorporates a 'seek harness' that ingests untrusted data from the URL via the
?t=query parameter to manipulate animation states. - Ingestion points: Data enters the execution flow through
URLSearchParamsin both the GSAP and Three.js implementation examples. - Boundary markers: The skill does not use specific delimiters or warnings for these inputs.
- Capability inventory: The ingested data controls the animation timeline (
tl.seek) and interacts with headless browsers (Playwright) during verification steps. - Sanitization: The input is passed through
parseFloat(), which provides a basic level of numeric validation. - [DYNAMIC_EXECUTION]: The skill uses ECMAScript Modules (ESM) to dynamically import the
GSAPandThree.jslibraries from remote URLs at runtime.
Audit Metadata