motion

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The script scripts/get-example.sh uses curl to fetch content from motion.dev to verify documentation availability. The script handles URL construction safely by mapping user-provided identifiers to a validated list of IDs stored in reference/examples.json, minimizing the risk of arbitrary URL fetching.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes a large dataset of animation example descriptions and metadata, creating a potential surface for indirect prompt injection if the source documentation contained adversarial instructions. The risk is considered low because the data is static and sourced from library documentation.
  • Ingestion points: Metadata and descriptive text are ingested from reference/examples.json and reference/examples.md.
  • Boundary markers: No explicit instructions to ignore embedded content were found in the processing scripts.
  • Capability inventory: The skill has the capability to perform network requests via curl in scripts/get-example.sh and perform local file searches via grep in scripts/search-examples.sh.
  • Sanitization: The scripts/get-example.sh script utilizes jq with the --arg parameter to safely pass identifier strings into queries, preventing command injection during the JSON lookup process.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 10:49 AM