motion-doctrine
Warn
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/seam-gate.mjsuseschild_process.spawnto execute shell commands throughsh -c. The specific command for the preview server can be overridden via the--server-cmdCLI flag, which presents a risk of command injection if arguments are provided from an untrusted source.\n- [EXTERNAL_DOWNLOADS]: The verification workflow inscripts/seam-gate.mjsexecutesnpx --yes hyperframes preview, which downloads and runs external code from the npm registry.\n- [REMOTE_CODE_EXECUTION]: Thescripts/seam-stamp.mjsscript dynamically generates animation code and writes it to an HTML file. This code is later executed in a browser environment during the verification and preview stages.\n- [COMMAND_EXECUTION]: Thescripts/seam-stamp.mjsscript performs file system write operations to modify project files (likeindex.html) based on user-specified flags.
Audit Metadata