motion-reel
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/meta.cjsusesvm.runInNewContextto execute and validate JavaScript animation files stored in the workspace'spieces/directory. This is used to ensure animation takes follow the correct API and metadata standards.\n- [DYNAMIC_EXECUTION]: The scriptsscripts/errors.mjs,scripts/page-shot.mjs, andscripts/shot.mjsutilize dynamic imports to load the Playwright package from computed paths.\n- [COMMAND_EXECUTION]: The skill instructions and associated scripts execute several shell commands, includingnpm install,npx playwright install, and various Node.js utilities to manage the build and verification process.\n- [EXTERNAL_DOWNLOADS]: The skill guides the installation of Playwright, which is a well-known browser automation service. It also fetches font and style assets from Google's public font repositories.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project data fromBRIEF.mdandSPECS.mdand interpolates it into prompts for sub-agent designers.\n - Ingestion points: Markdown files
BRIEF.mdandSPECS.mdare read from the workspace to configure animation generation.\n - Boundary markers: Brackets are used in the sub-agent prompt template to indicate external data placement.\n
- Capability inventory: The skill can perform file system operations, shell command execution, and headless browser control.\n
- Sanitization: There is no explicit sanitization or validation of the input markdown content before it is processed by sub-agents.
Audit Metadata