animate

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill generates React component code based on user-supplied descriptions and optional external data from the Gemini API.
  • Ingestion points: Animation descriptions provided via user arguments and creative suggestions fetched from the Gemini 3.1 Pro API.
  • Boundary markers: There are no specified delimiters or validation rules for how this external content is interpolated into the generated JSX/TSX files.
  • Capability inventory: The agent uses Write to create source files and Bash to run a local development server.
  • Sanitization: The instructions do not detail any filtering or escaping of user/API data before it becomes part of the executable application.
  • [COMMAND_EXECUTION]: The skill executes local shell scripts and package manager commands to scaffold and run projects.
  • It runs a local scaffolding script at ~/.claude/skills/animate/scripts/scaffold.sh.
  • It uses npm install and npm run dev to manage dependencies and execute the generated code.
  • [DYNAMIC_EXECUTION]: The skill dynamically generates a Vite + React project and executes it.
  • Source code is generated at runtime based on natural language descriptions and is immediately executed in a local development environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 07:25 AM
Security Audit — agent-trust-hub — animate