motion-recreate
Pass
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires shell execution of Node.js and FFmpeg to measure video frames and manage project builds. Evidence is found in SKILL.md instructions for running hyperframesCli and in the bundled scripts/measure_frame.mjs which spawns subprocesses for media processing.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user-provided video URLs and workspace documents (READMEs, marketing copy). It lacks explicit boundary markers or sanitization for this content, creating a surface for indirect instructions to influence agent behavior.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the retrieval of video files from external URLs provided by the user for the purpose of recreation and analysis.
- [PROMPT_INJECTION]: The instructions include a concealment directive requiring the agent to hide the skill's logic and file structure from the user by explicitly prohibiting mentions or links to the skill's files in responses.
Audit Metadata