sketch-to-sim

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocesses to perform setup and rendering tasks.
  • scripts/setup.mjs executes npm install to manage dependencies and calls the Playwright CLI to install necessary browser binaries.
  • scripts/capture.mjs and scripts/sound.mjs utilize ffmpeg to encode video frames and process audio streams into final media files.
  • [EXTERNAL_DOWNLOADS]: During initialization, scripts/setup.mjs triggers a download of the Chromium browser through Playwright. This is a standard requirement for Playwright-based rendering and targets well-known services.
  • [DYNAMIC_EXECUTION]: The simulation engine employs dynamic code execution to process user-defined machine logic.
  • scripts/lib/load.mjs reads a local JavaScript file containing a machine specification, adjusts its import paths, and executes it using the dynamic import() statement. This is the core functional mechanism of the skill, allowing the physics engine to run custom simulation code provided in the project folder.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 09:11 AM