cinematic-scroll
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes automation and utility scripts that execute shell commands, such as
ffmpegfor video processing inexamples/kern-calibration/assets/generate-i2v.pyandgitfor repository consistency checks intools/check-consistency.mjs. These operations are well-scoped and essential for the tool's functionality. - [EXTERNAL_DOWNLOADS]: Examples within the skill fetch libraries like
three.js,gsap, andmodel-viewerfrom well-known CDNs includingunpkg.comandjsdelivr.net. It also supports optional asset generation via thefal.aiservice. All external references target reputable technology providers. - [CREDENTIALS_UNSAFE]: The skill utilizes a billable API key (
FAL_KEY) for AI generation tasks. It implements strict safeguards, instructing users to store keys in gitignored.env.localfiles and providing a consistency scanner (tools/check-consistency.mjs) that proactively checks for accidentally leaked secrets. - [DYNAMIC_EXECUTION]: The
compile-choreography.mjsscript provides a core feature that compiles a declarative JSON schema into runnable GSAP animation code. This process is highly structured and does not involveeval()or other high-risk patterns for executing untrusted data. - [SAFE]: The skill demonstrates a high level of security awareness, employing Subresource Integrity (SRI) for versioned CDN scripts and maintaining clear boundaries between local development and production deployment.
Audit Metadata