cinematic-scroll

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes automation and utility scripts that execute shell commands, such as ffmpeg for video processing in examples/kern-calibration/assets/generate-i2v.py and git for repository consistency checks in tools/check-consistency.mjs. These operations are well-scoped and essential for the tool's functionality.
  • [EXTERNAL_DOWNLOADS]: Examples within the skill fetch libraries like three.js, gsap, and model-viewer from well-known CDNs including unpkg.com and jsdelivr.net. It also supports optional asset generation via the fal.ai service. All external references target reputable technology providers.
  • [CREDENTIALS_UNSAFE]: The skill utilizes a billable API key (FAL_KEY) for AI generation tasks. It implements strict safeguards, instructing users to store keys in gitignored .env.local files and providing a consistency scanner (tools/check-consistency.mjs) that proactively checks for accidentally leaked secrets.
  • [DYNAMIC_EXECUTION]: The compile-choreography.mjs script provides a core feature that compiles a declarative JSON schema into runnable GSAP animation code. This process is highly structured and does not involve eval() or other high-risk patterns for executing untrusted data.
  • [SAFE]: The skill demonstrates a high level of security awareness, employing Subresource Integrity (SRI) for versioned CDN scripts and maintaining clear boundaries between local development and production deployment.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 12:52 PM
Security Audit — agent-trust-hub — cinematic-scroll