motion-designer
Warn
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill requests an ElevenLabs API key from the user and stores it in the file '~/.config/elevenlabs/api_key' for persistent access.
- [COMMAND_EXECUTION]: The skill relies on a extensive collection of Python and Shell scripts that execute system commands via 'subprocess.run' and 'os.system' to perform operations with FFmpeg, Potrace, and Playwright. Some of these calls, particularly in 'render.py', are vulnerable to shell injection if directory paths are manipulated.
- [INDIRECT_PROMPT_INJECTION]: The skill extracts brand data and content from user-supplied URLs to build video scripts and design elements. This untrusted data is processed without clear boundary markers or complete sanitization, allowing malicious instructions on target sites to potentially influence agent behavior. Ingestion points: 'SKILL.md' Flow A (brand extraction). Boundary markers: None. Capability inventory: Extensive subprocess execution capabilities for file writing and media rendering across all scripts. Sanitization: Validation logic is limited to structured campaign data in 'scripts/validate_campaign.py'.
- [PROMPT_INJECTION]: The skill's frontmatter and instructions in 'SKILL.md' attempt to enforce the use of a non-standard model version ('claude-opus-5-5') and include instructions to disregard standard environment checks.
- [EXTERNAL_DOWNLOADS]: The skill fetches media assets and 3D models from well-known services and repositories such as GitHub (three.js), Wikimedia Commons, Poly Haven, and NASA.
Audit Metadata