motion
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes shell scripts (
scripts/init-motion.shandscripts/optimize-bundle.sh) designed to automate project initialization and bundle optimization. These scripts perform environment detection by readingpackage.jsonand create React component templates in the user's project directory. - [EXTERNAL_DOWNLOADS]: The instructions guide the agent to install standard, well-known animation packages (
motionandframer-motion) from official registries using standard package managers. All external references point to official documentation and trusted repositories like GitHub. - [INDIRECT_PROMPT_INJECTION]: The skill provides structured templates and setup logic for integration into user codebases.
- Ingestion points: The scripts read project information from
package.jsonand accept user input for package selection during initialization. - Boundary markers: The scripts use heredocs (
<< 'EOF') to isolate the generated template code from the script's execution logic. - Capability inventory: The initialization script performs file system operations (creating directories and writing files) and executes package manager installation commands.
- Sanitization: The scripts use static templates and do not interpolate unvalidated user input directly into executable code segments.
Audit Metadata