layer-motion-graphics
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to prompt the user to run
npx skills add layerai/skills --skill <name>to install missing dependencies. This involves command-line interaction with theskillsutility to manage platform extensions. \n- [EXTERNAL_DOWNLOADS]: The suggested setup command utilizesnpxto fetch and execute packages from the NPM registry. These resources are associated with the skill's author (layerai) and represent standard environment configuration for the vendor's ecosystem. \n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external user-provided assets, constituting an ingestion surface for potentially untrusted data. \n - Ingestion points: Logo images (PNG) and font files (.ttf, .otf) referenced in
SKILL.md. \n - Boundary markers: The skill provides instructions to use
last_frameto pin exact artwork andfont_file_idfor precise typography control. \n - Capability inventory: Tools such as
render_video_timeline,execute_forge, andrender_textare available to process these assets. \n - Sanitization: Instructions focus on visual validation (e.g., "check every frame for warping") rather than programmatic sanitization of asset metadata.
Audit Metadata