lottie-animator

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [SAFE]: The skill is a well-documented development utility focused on Lottie animation production. No malicious patterns, obfuscation, or unauthorized data exfiltration attempts were detected.
  • [COMMAND_EXECUTION]: The skill instructs the agent to use Bash for running local Python and Node.js utilities (lottie_lint.py, render.mjs, svg2lottie.py, recolor.py). These tools are used for animation processing and validation, which is the stated purpose of the skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data sources including SVG files and existing Lottie JSON files.
  • Ingestion points: SVG files are ingested via svg2lottie.py and Lottie JSON files are processed via recolor.py or directly read for repair in SKILL.md.
  • Boundary markers: None explicitly defined in the prompt instructions.
  • Capability inventory: The skill has Bash, Read, and Write capabilities across all files.
  • Sanitization: The skill utilizes a linter (lottie_lint.py) to validate the structure of the generated animations.
  • [DYNAMIC_EXECUTION]: The skill workflow involves copying Python 'recipes' (templates) and executing them to generate animation files. This is a routine developer-agent task and the scripts use a local library (motion.py) provided with the skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 02:46 AM