motion-method
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill coordinates a video production pipeline by executing local Node.js and Bun scripts (e.g.,
beats-check.mjs) to validate project data. These scripts perform transparent operations on local files within the project's.motion/directory and do not involve network requests or dynamic code evaluation. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository content, such as README files and product screenshots, to derive inputs for motion briefs. This ingestion is mitigated by a structured human-in-the-loop approval process where the owner must explicitly verify the generated brief and visual system before any scene code is written.
- [SAFE]: The skill includes instructions for integrating with a security harness (
@fusengine/harness) that protects sensitive paths and environment variables. It explicitly directs the agent to avoid modifying protected state files and provides clear error handling for denied actions.
Audit Metadata