motion
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/get-example.shusescurlto fetch content frommotion.devto verify documentation availability. The script handles URL construction safely by mapping user-provided identifiers to a validated list of IDs stored inreference/examples.json, minimizing the risk of arbitrary URL fetching. - [INDIRECT_PROMPT_INJECTION]: The skill processes a large dataset of animation example descriptions and metadata, creating a potential surface for indirect prompt injection if the source documentation contained adversarial instructions. The risk is considered low because the data is static and sourced from library documentation.
- Ingestion points: Metadata and descriptive text are ingested from
reference/examples.jsonandreference/examples.md. - Boundary markers: No explicit instructions to ignore embedded content were found in the processing scripts.
- Capability inventory: The skill has the capability to perform network requests via
curlinscripts/get-example.shand perform local file searches viagrepinscripts/search-examples.sh. - Sanitization: The
scripts/get-example.shscript utilizesjqwith the--argparameter to safely pass identifier strings into queries, preventing command injection during the JSON lookup process.
Audit Metadata