painted-animation

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/new_project.sh script automates project setup by running npm install and copying template files.
  • [COMMAND_EXECUTION]: The scripts/beat_grid.py utility uses subprocess.run to call ffmpeg for audio analysis. It follows safe practices by using a list-based command structure rather than a shell string.
  • [DYNAMIC_EXECUTION]: The template/render.mjs script uses eval() to parse and compute coordinate expressions for frame cropping. This allows users to define dynamic crops that follow world points during the rendering process.
  • [DYNAMIC_EXECUTION]: The engine leverages Puppeteer's page.evaluate() to execute animation code in a headless browser, which is necessary for the procedural generation of frames.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as lyrics and user descriptions to generate animation code. While this creates a surface for indirect prompt injection, the impact is minimized by the skill's design, which generates code for a local p5.js environment rather than performing sensitive system operations based on that data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 04:03 PM