awwwards-motion-study

Pass

Audited by Gen Agent Trust Hub on Nov 11, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves analyzing untrusted data from external websites (HTML, JavaScript bundles, CSS), which could contain malicious instructions.
  • Ingestion points: External data is ingested via tools such as analyze_bundle, analyze_stack, analyze_scroll_map, and record_site_motion.
  • Boundary markers: The skill does not define specific delimiters or instructions to prevent the agent from obeying commands potentially embedded in the analyzed web content.
  • Capability inventory: The agent has the ability to write to the local file system (e.g., saving video and script chunks) and execute shell commands (ffmpeg, node).
  • Sanitization: Ingested content is processed for technical features (like animation triggers) but is not explicitly sanitized for prompt injection attacks.
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands and local scripts to process video data.
  • Evidence: Provides ffmpeg command strings for generating image tiles from recordings (ffmpeg -i reference.webm -vf ...).
  • Evidence: Instructs the agent to run Node.js scripts (node scripts/record-scrollthrough.mjs) from a local repository checkout.
  • [EXTERNAL_DOWNLOADS]: The skill references an external repository for necessary scripts and dependencies.
  • Evidence: Directs the agent to the author's GitHub repository https://github.com/INSANE0777/Awwwards-mcp for recording scripts.
  • [DYNAMIC_EXECUTION]: The skill generates executable code stubs based on parameters extracted from external sites.
  • Evidence: The build_gsap_stub tool creates a runnable JavaScript stub using durations, easings, and triggers discovered during the site analysis phase.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 11, 2026, 10:21 PM