motion-showreel
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/audio.mjsdynamically imports locally defined audio score files usingimport()with computed file URLs. - [DYNAMIC_EXECUTION]:
scripts/lib/tone-render.mjsgenerates an HTML runner script at runtime and executes it within a headless Chromium instance using Playwright to render tier-2 audio. - [DYNAMIC_EXECUTION]:
scripts/audio.mjsexecutes hardcoded Python code viapython3 -cto interface with thelibrosalibrary for beat detection analysis. - [COMMAND_EXECUTION]: The skill makes extensive use of
execFileSyncandspawnSyncto call system binaries likeffmpegandffprobefor media processing, encoding, and technical acceptance checks. - [EXTERNAL_DOWNLOADS]: The skill fetches audio sample packs from well-known sources (
tonejs.github.io) and downloads browser dependencies via the Playwright CLI during initialization. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided files (HTML, JS, audio, video) and uses them to drive execution in both Node.js and browser contexts. Ingestion points include
render.mjsandaudio.mjs. While XML boundary markers are suggested in templates, the skill does not perform explicit sanitization on interpolated external content.
Audit Metadata