cartoon-3d-short
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill operates entirely on local project files and generates media assets (video, audio, and images). It utilizes standard temporary directories for rendering bundles and stores project-specific data in the user's home directory. No sensitive data access or network-based exfiltration patterns were identified.
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill requires established tools and libraries such as Remotion, Node.js, Python 3, and ffmpeg. It executes local scripts and system tools through controlled argument lists. There is no evidence of downloading or executing arbitrary code from untrusted remote sources.
- [COMMAND_EXECUTION]: The skill uses Python's subprocess module to invoke media processing tools (ffmpeg, ffprobe) and Node.js for rendering. These invocations use hardcoded or strictly defined parameter lists, mitigating command injection risks.
- [DYNAMIC_EXECUTION]: The skill utilizes standard shaders (GLSL) compiled at runtime by three.js for 3D rendering. This is a standard and expected behavior for graphics-heavy AI agent skills and does not pose a security risk in this context.
Audit Metadata