design-motion-audit
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The test suite (scripts/tests/test_motion_scripts.py) utilizes subprocess.run to execute the skill's own scripts for functional verification. This execution is scoped to internal files and does not process untrusted input as shell commands.\n- [EXTERNAL_DOWNLOADS]: Reference documentation (references/runtime-verification.md) mentions developer tools like npx motionscore and playwright-cli for runtime verification. These are standard industry tools and are recommended for manual or supervised execution rather than being automatically invoked by malicious scripts.\n- [SAFE]: The skill demonstrates defensive programming by implementing path traversal checks in scripts/scaffold_motion_tokens.py, ensuring that generated files are restricted to the intended project directory.
Audit Metadata