skills/motiondivision/ai-kit/motion/Gen Agent Trust Hub

motion

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs runtime performance audits using the command npx motionscore <url> --agent, which executes a CLI tool against user-provided URLs. It also handles library migration by managing package installation and uninstallation.- [DYNAMIC_EXECUTION]: The skill features interactive components like open-transition-editor that provide dynamic UI and feedback within the chat, allowing the agent to receive and apply real-time configuration changes.- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes external content from documentation servers and example repositories, which could potentially contain malicious instructions or biased content.- [INDIRECT_PROMPT_INJECTION]: Ingestion points: Content is ingested from external resources via search-motion-docs, search-motion-source, and the results of runtime audits performed on arbitrary URLs.- [INDIRECT_PROMPT_INJECTION]: Boundary markers: There are no explicit instructions or delimiters defined to isolate external documentation or source code from the agent's primary instruction set.- [INDIRECT_PROMPT_INJECTION]: Capability inventory: The skill possesses capabilities for shell command execution, complex file modification, and extensive external data retrieval.- [INDIRECT_PROMPT_INJECTION]: Sanitization: No specific sanitization or validation logic is implemented for the documentation or code examples retrieved from external providers before being processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 12:16 AM