sketch-to-sim
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses subprocesses to perform setup and rendering tasks.
scripts/setup.mjsexecutesnpm installto manage dependencies and calls the Playwright CLI to install necessary browser binaries.scripts/capture.mjsandscripts/sound.mjsutilizeffmpegto encode video frames and process audio streams into final media files.- [EXTERNAL_DOWNLOADS]: During initialization,
scripts/setup.mjstriggers a download of the Chromium browser through Playwright. This is a standard requirement for Playwright-based rendering and targets well-known services. - [DYNAMIC_EXECUTION]: The simulation engine employs dynamic code execution to process user-defined machine logic.
scripts/lib/load.mjsreads a local JavaScript file containing a machine specification, adjusts its import paths, and executes it using the dynamicimport()statement. This is the core functional mechanism of the skill, allowing the physics engine to run custom simulation code provided in the project folder.
Audit Metadata