create-motion-graphics
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill is designed to author and modify JSX code at runtime through tools such as
create_motion_graphic_from_codeandedit_asset. - The execution risk is mitigated by a mandatory 'Motion Graphic Code Contract' that restricts the JSX environment to pure JavaScript (no TypeScript), prohibits all
importandexportstatements, and limits access to a specific set of pre-injected globals (e.g.,React,spring,useCurrentFrame). - The code generation is based on established library references and project-specific metadata retrieved through vendor-provided tools.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content, such as user-provided brand references, video transcripts, and library search results, which are used to derive graphic properties and layouts.
- Ingestion points: Untrusted data enters the agent's context through project transcripts, video frame evidence, and library metadata fetched via
browse_library. - Boundary markers: The instructions do not define specific text delimiters, but they mandate the use of the host's design spec and visual verification of composed frames to ensure alignment with project styles.
- Capability inventory: The skill possesses the ability to create new assets (
create_motion_graphic_from_code), modify existing asset code (edit_asset), and place items on the project timeline (edit_item). - Sanitization: The skill includes a validation mechanism (
metadata.renderContract) that checks for syntax errors, API violations, and renderer incompatibilities before code execution.
Audit Metadata