motion-graphics
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several system utilities to process assets and render the final video.
- Uses
ffmpegandffprobefor video encoding, frame capture, and image analysis ingrounding/locate.mjsandcategories/maps/bake-basemap.mjs. - Uses
npx hyperframesfor project initialization, rendering, linting, and inspecting compositions. - [EXTERNAL_DOWNLOADS]: The skill references and fetches assets from well-known and trusted external services.
- Downloads MapLibre, TopoJSON, and world-atlas data from
cdn.jsdelivr.netfor the map-baking functionality incategories/maps/bake-basemap.mjs. - Accesses official Google Gemini API endpoints (
generativelanguage.googleapis.com) for optional automated object detection ingrounding/locate.mjs. - Accesses established tile providers (Esri and CARTO) for map imagery.
- References Google Fonts via CDN for typography.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes user-provided intent and external search results (news, tweets, web pages).
- Ingestion points: Untrusted data enters via user requests in
SKILL.mdand external search results resolved inphases/source/guide.md. - Boundary markers: Present. The skill utilizes a structured intermediate representation (IR) defined in
references/shot-plan-ir.mdto separate planning from execution. - Capability inventory: Capabilities include subprocess execution (
ffmpeg), file system writes (compositions/index.html), and network access for asset sourcing. - Sanitization: The workflow separates the "Director" (planning) and "Builder" (execution) roles, relying on the Builder to generate static HTML compositions based on validated JSON plans.
- [DYNAMIC_EXECUTION]: The skill uses dynamic execution techniques to generate graphics.
categories/maps/bake-basemap.mjslaunches a headless browser usingpuppeteer-corewith the--no-sandboxflag to bake map imagery. This is a standard requirement for headless Chromium in certain environments and is used here to render trusted libraries and map tiles.
Audit Metadata