painted-animation
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/new_project.shscript automates project setup by runningnpm installand copying template files. - [COMMAND_EXECUTION]: The
scripts/beat_grid.pyutility usessubprocess.runto callffmpegfor audio analysis. It follows safe practices by using a list-based command structure rather than a shell string. - [DYNAMIC_EXECUTION]: The
template/render.mjsscript useseval()to parse and compute coordinate expressions for frame cropping. This allows users to define dynamic crops that follow world points during the rendering process. - [DYNAMIC_EXECUTION]: The engine leverages Puppeteer's
page.evaluate()to execute animation code in a headless browser, which is necessary for the procedural generation of frames. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as lyrics and user descriptions to generate animation code. While this creates a surface for indirect prompt injection, the impact is minimized by the skill's design, which generates code for a local p5.js environment rather than performing sensitive system operations based on that data.
Audit Metadata