lottie-animator
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [SAFE]: The skill is a well-documented development utility focused on Lottie animation production. No malicious patterns, obfuscation, or unauthorized data exfiltration attempts were detected.
- [COMMAND_EXECUTION]: The skill instructs the agent to use
Bashfor running local Python and Node.js utilities (lottie_lint.py,render.mjs,svg2lottie.py,recolor.py). These tools are used for animation processing and validation, which is the stated purpose of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data sources including SVG files and existing Lottie JSON files.
- Ingestion points: SVG files are ingested via
svg2lottie.pyand Lottie JSON files are processed viarecolor.pyor directly read for repair inSKILL.md. - Boundary markers: None explicitly defined in the prompt instructions.
- Capability inventory: The skill has
Bash,Read, andWritecapabilities across all files. - Sanitization: The skill utilizes a linter (
lottie_lint.py) to validate the structure of the generated animations. - [DYNAMIC_EXECUTION]: The skill workflow involves copying Python 'recipes' (templates) and executing them to generate animation files. This is a routine developer-agent task and the scripts use a local library (
motion.py) provided with the skill.
Audit Metadata