layer-motion-graphics

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to prompt the user to run npx skills add layerai/skills --skill <name> to install missing dependencies. This involves command-line interaction with the skills utility to manage platform extensions. \n- [EXTERNAL_DOWNLOADS]: The suggested setup command utilizes npx to fetch and execute packages from the NPM registry. These resources are associated with the skill's author (layerai) and represent standard environment configuration for the vendor's ecosystem. \n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external user-provided assets, constituting an ingestion surface for potentially untrusted data. \n
  • Ingestion points: Logo images (PNG) and font files (.ttf, .otf) referenced in SKILL.md. \n
  • Boundary markers: The skill provides instructions to use last_frame to pin exact artwork and font_file_id for precise typography control. \n
  • Capability inventory: Tools such as render_video_timeline, execute_forge, and render_text are available to process these assets. \n
  • Sanitization: Instructions focus on visual validation (e.g., "check every frame for warping") rather than programmatic sanitization of asset metadata.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 06:45 PM