motion-canvas
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard Node.js commands such as npx @motion-canvas/create and npm install for project scaffolding and dependency management. These are routine operations for the framework described.
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a pipeline for turning user requirements into animation code. This presents a surface for processing untrusted data, although the risk is minimized by the context of generating source code for development. * Ingestion points: User animation requirements processed to generate scene files. * Boundary markers: None present in templates. * Capability inventory: Project initialization via npx, package installation via npm, and ffmpeg environment checks. * Sanitization: None present.
- [SAFE]: No obfuscation, hardcoded credentials, or unauthorized network activity were identified. The setup script only performs environment checks and package metadata lookups.
Audit Metadata