elite-motion-graphics
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/render.mjsutility executes system binariesffmpegandffprobeusingexecFileto process video and verify media integrity. This is the primary intended function of the skill. - [DYNAMIC_EXECUTION]: The skill generates and executes local HTML/JavaScript motion scenes within a headless Chromium browser managed by Playwright. This execution is contained within the local project environment.
- [DATA_EXFILTRATION]: To serve assets to the rendering browser,
scripts/render.mjscreates a local HTTP server. Security is maintained by binding exclusively to127.0.0.1, implementing path traversal checks to prevent access to files outside the project root, and configuring the browser context to block all non-local network requests, effectively preventing exfiltration during execution. - [INDIRECT_PROMPT_INJECTION]: The skill anticipates the ingestion of untrusted data from user briefs and reference media. It includes defensive instructions to prevent this data from overriding agent behavior, specifically mandating that such content be treated as research rather than instructional input, and providing behavioral evaluation cases to verify the agent's resistance to reference-based injection attacks.
Audit Metadata