motion-doctrine

Warn

Audited by Gen Agent Trust Hub on Jul 16, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/seam-gate.mjs uses child_process.spawn to execute shell commands through sh -c. The specific command for the preview server can be overridden via the --server-cmd CLI flag, which presents a risk of command injection if arguments are provided from an untrusted source.\n- [EXTERNAL_DOWNLOADS]: The verification workflow in scripts/seam-gate.mjs executes npx --yes hyperframes preview, which downloads and runs external code from the npm registry.\n- [REMOTE_CODE_EXECUTION]: The scripts/seam-stamp.mjs script dynamically generates animation code and writes it to an HTML file. This code is later executed in a browser environment during the verification and preview stages.\n- [COMMAND_EXECUTION]: The scripts/seam-stamp.mjs script performs file system write operations to modify project files (like index.html) based on user-specified flags.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 16, 2026, 09:32 PM
Security Audit — agent-trust-hub — motion-doctrine