motion-production
Pass
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute specific local Node.js scripts and CLI tools for project linting, runtime diagnosis, and export verification, including
lint-project.mjs,npm-installer.mjs, andverify-export.ts. - [DYNAMIC_EXECUTION]: The core functionality requires the agent to generate and save executable HTML, CSS, and JavaScript files (Hyperframes) that are subsequently loaded and rendered by the host browser and production engine.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, such as user-supplied media assets and project metadata files, which are interpolated into the authoring and production pipeline. * Ingestion points: User-provided media assets and production folder files like
STATE.md,BRIEF.md, andSTORYBOARD.md. * Boundary markers: Native linter and technical verification scripts are used to validate project structure and output. * Capability inventory: File system writes, shell script execution, and browser-based previews. * Sanitization: Instructions specify the use of argument-safe shell invocation and automated linting before project interaction.
Audit Metadata