motion-graphics

Pass

Audited by Gen Agent Trust Hub on Nov 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes several system utilities to process assets and render the final video.
  • Uses ffmpeg and ffprobe for video encoding, frame capture, and image analysis in grounding/locate.mjs and categories/maps/bake-basemap.mjs.
  • Uses npx hyperframes for project initialization, rendering, linting, and inspecting compositions.
  • [EXTERNAL_DOWNLOADS]: The skill references and fetches assets from well-known and trusted external services.
  • Downloads MapLibre, TopoJSON, and world-atlas data from cdn.jsdelivr.net for the map-baking functionality in categories/maps/bake-basemap.mjs.
  • Accesses official Google Gemini API endpoints (generativelanguage.googleapis.com) for optional automated object detection in grounding/locate.mjs.
  • Accesses established tile providers (Esri and CARTO) for map imagery.
  • References Google Fonts via CDN for typography.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes user-provided intent and external search results (news, tweets, web pages).
  • Ingestion points: Untrusted data enters via user requests in SKILL.md and external search results resolved in phases/source/guide.md.
  • Boundary markers: Present. The skill utilizes a structured intermediate representation (IR) defined in references/shot-plan-ir.md to separate planning from execution.
  • Capability inventory: Capabilities include subprocess execution (ffmpeg), file system writes (compositions/index.html), and network access for asset sourcing.
  • Sanitization: The workflow separates the "Director" (planning) and "Builder" (execution) roles, relying on the Builder to generate static HTML compositions based on validated JSON plans.
  • [DYNAMIC_EXECUTION]: The skill uses dynamic execution techniques to generate graphics.
  • categories/maps/bake-basemap.mjs launches a headless browser using puppeteer-core with the --no-sandbox flag to bake map imagery. This is a standard requirement for headless Chromium in certain environments and is used here to render trusted libraries and map tiles.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 1, 2026, 09:33 PM