skills/basmilius/skills/motion-reel/Gen Agent Trust Hub

motion-reel

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/meta.cjs uses vm.runInNewContext to execute and validate JavaScript animation files stored in the workspace's pieces/ directory. This is used to ensure animation takes follow the correct API and metadata standards.\n- [DYNAMIC_EXECUTION]: The scripts scripts/errors.mjs, scripts/page-shot.mjs, and scripts/shot.mjs utilize dynamic imports to load the Playwright package from computed paths.\n- [COMMAND_EXECUTION]: The skill instructions and associated scripts execute several shell commands, including npm install, npx playwright install, and various Node.js utilities to manage the build and verification process.\n- [EXTERNAL_DOWNLOADS]: The skill guides the installation of Playwright, which is a well-known browser automation service. It also fetches font and style assets from Google's public font repositories.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project data from BRIEF.md and SPECS.md and interpolates it into prompts for sub-agent designers.\n
  • Ingestion points: Markdown files BRIEF.md and SPECS.md are read from the workspace to configure animation generation.\n
  • Boundary markers: Brackets are used in the sub-agent prompt template to indicate external data placement.\n
  • Capability inventory: The skill can perform file system operations, shell command execution, and headless browser control.\n
  • Sanitization: There is no explicit sanitization or validation of the input markdown content before it is processed by sub-agents.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 12:26 AM
Security Audit — agent-trust-hub — motion-reel