animate
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill generates React component code based on user-supplied descriptions and optional external data from the Gemini API.
- Ingestion points: Animation descriptions provided via user arguments and creative suggestions fetched from the Gemini 3.1 Pro API.
- Boundary markers: There are no specified delimiters or validation rules for how this external content is interpolated into the generated JSX/TSX files.
- Capability inventory: The agent uses
Writeto create source files andBashto run a local development server. - Sanitization: The instructions do not detail any filtering or escaping of user/API data before it becomes part of the executable application.
- [COMMAND_EXECUTION]: The skill executes local shell scripts and package manager commands to scaffold and run projects.
- It runs a local scaffolding script at
~/.claude/skills/animate/scripts/scaffold.sh. - It uses
npm installandnpm run devto manage dependencies and execute the generated code. - [DYNAMIC_EXECUTION]: The skill dynamically generates a Vite + React project and executes it.
- Source code is generated at runtime based on natural language descriptions and is immediately executed in a local development environment.
Audit Metadata