motion-graphics
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes system utilities including
ffmpeg,ffprobe, andbase64via Node.jschild_processmodules to perform video encoding, image metadata extraction, and data encoding tasks. - [EXTERNAL_DOWNLOADS]: The skill dynamically loads various frontend libraries (GSAP, MapLibre GL) and geographic datasets (world-atlas) from the JSDelivr CDN. These resources are standard dependencies for the skill's mapping and animation capabilities.
- [DATA_EXFILTRATION]: The
locate.mjsutility transmits image data to the Google Gemini API (generativelanguage.googleapis.com) to facilitate automated object localization. This functionality is documented as an optional feature requiring a validGEMINI_API_KEYorGOOGLE_API_KEY. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface for untrusted external data, including web page screenshots and DOM captures fetched via the
hyperframes capturecommand. These assets are used as background layers and coordinate sources for animations.
Audit Metadata