keyframe-animation

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute a vendor-provided bash script (ofox-video.sh) and standard utilities like curl and jq. These tools are used for legitimate operations including API key verification, querying model metadata, pricing estimation, and initiating video generation jobs.
  • [DYNAMIC_EXECUTION]: A bash search routine is utilized to dynamically locate the ofox-video-core dependency across multiple installation paths, including sibling directories and user home subdirectories (~/.agents/skills, ~/.claude/skills).
  • [EXTERNAL_DOWNLOADS]: The skill facilitates network communication with the vendor's official API endpoint (app.ofox.ai) to submit video generation requests and retrieve resulting artifacts. These operations are conducted through the core dependency script and are subject to a mandatory user approval gate.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external image files (start and end frames) provided by the user and interpolates descriptions of their content into a generated motion prompt.
  • Ingestion points: File paths for the primary and secondary frame images provided by the user in SKILL.md.
  • Boundary markers: The agent is instructed to use a highly structured prompt template with specific section headers (SUBJECT, SCENE, MOTION, ENDING, AVOID) to isolate components.
  • Capability inventory: The skill possesses the capability to execute shell commands, perform network requests (via curl), and write files to local directories (via --out-dir).
  • Sanitization: The workflow incorporates a dry-run feature and a mandatory approval gate where the final prompt and estimated cost are presented to the user for confirmation before any paid API execution occurs.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 08:58 AM