motion-pipeline
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install several external Python dependencies (numpy, scipy, pygltflib, Pillow) from public package registries.
- [COMMAND_EXECUTION]: The skill provides a series of bash commands to set up a Python virtual environment and run motion processing scripts.
- [DATA_EXFILTRATION]: The environment setup documentation contains hardcoded absolute system paths (e.g., /home/feedgen/...) that reveal host-specific directory structures.
- [REMOTE_CODE_EXECUTION]: Documentation for generate-move-ts.py indicates it uses dynamic module loading via importlib to interact with other internal scripts.
- [PROMPT_INJECTION]: The skill processes untrusted BVH mocap data and interpolates user-supplied strings into generated TypeScript code, representing an indirect injection surface.
Audit Metadata