motion-showreel

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/audio.mjs dynamically imports locally defined audio score files using import() with computed file URLs.
  • [DYNAMIC_EXECUTION]: scripts/lib/tone-render.mjs generates an HTML runner script at runtime and executes it within a headless Chromium instance using Playwright to render tier-2 audio.
  • [DYNAMIC_EXECUTION]: scripts/audio.mjs executes hardcoded Python code via python3 -c to interface with the librosa library for beat detection analysis.
  • [COMMAND_EXECUTION]: The skill makes extensive use of execFileSync and spawnSync to call system binaries like ffmpeg and ffprobe for media processing, encoding, and technical acceptance checks.
  • [EXTERNAL_DOWNLOADS]: The skill fetches audio sample packs from well-known sources (tonejs.github.io) and downloads browser dependencies via the Playwright CLI during initialization.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided files (HTML, JS, audio, video) and uses them to drive execution in both Node.js and browser contexts. Ingestion points include render.mjs and audio.mjs. While XML boundary markers are suggested in templates, the skill does not perform explicit sanitization on interpolated external content.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 03:44 AM