motion
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs runtime performance audits using the command
npx motionscore <url> --agent, which executes a CLI tool against user-provided URLs. It also handles library migration by managing package installation and uninstallation.- [DYNAMIC_EXECUTION]: The skill features interactive components likeopen-transition-editorthat provide dynamic UI and feedback within the chat, allowing the agent to receive and apply real-time configuration changes.- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes external content from documentation servers and example repositories, which could potentially contain malicious instructions or biased content.- [INDIRECT_PROMPT_INJECTION]: Ingestion points: Content is ingested from external resources viasearch-motion-docs,search-motion-source, and the results of runtime audits performed on arbitrary URLs.- [INDIRECT_PROMPT_INJECTION]: Boundary markers: There are no explicit instructions or delimiters defined to isolate external documentation or source code from the agent's primary instruction set.- [INDIRECT_PROMPT_INJECTION]: Capability inventory: The skill possesses capabilities for shell command execution, complex file modification, and extensive external data retrieval.- [INDIRECT_PROMPT_INJECTION]: Sanitization: No specific sanitization or validation logic is implemented for the documentation or code examples retrieved from external providers before being processed by the agent.
Audit Metadata