create-motion-graphics

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill is designed to author and modify JSX code at runtime through tools such as create_motion_graphic_from_code and edit_asset.
  • The execution risk is mitigated by a mandatory 'Motion Graphic Code Contract' that restricts the JSX environment to pure JavaScript (no TypeScript), prohibits all import and export statements, and limits access to a specific set of pre-injected globals (e.g., React, spring, useCurrentFrame).
  • The code generation is based on established library references and project-specific metadata retrieved through vendor-provided tools.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content, such as user-provided brand references, video transcripts, and library search results, which are used to derive graphic properties and layouts.
  • Ingestion points: Untrusted data enters the agent's context through project transcripts, video frame evidence, and library metadata fetched via browse_library.
  • Boundary markers: The instructions do not define specific text delimiters, but they mandate the use of the host's design spec and visual verification of composed frames to ensure alignment with project styles.
  • Capability inventory: The skill possesses the ability to create new assets (create_motion_graphic_from_code), modify existing asset code (edit_asset), and place items on the project timeline (edit_item).
  • Sanitization: The skill includes a validation mechanism (metadata.renderContract) that checks for syntax errors, API violations, and renderer incompatibilities before code execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 03:25 PM