huashu-art-motion
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill initiates a download of approximately 154 MB from a community GitHub repository (
alchaincyf/huashu-art-motion) to install its full set of animation grammars, art styles, and scripts. - [COMMAND_EXECUTION]: The setup instructions direct the user to execute shell commands for environment detection and dependency installation, including
uv run --with playwright playwright install chromiumto provision the browser engine used for rendering frames. - [INDIRECT_PROMPT_INJECTION]: The skill operates by processing natural language storyboard descriptions, nouns, verbs, and voice-over parameters which are then used to generate animation code.
- Ingestion points: Storyboard shot lists and voice-over parameters provided in the animation pipeline.
- Boundary markers: None identified in the provided skill instructions to isolate user-provided text from the animation logic.
- Capability inventory: Utilizes
ffmpegfor video processing andplaywrightfor rendering, which involve subprocess execution and local file writes. - Sanitization: No explicit sanitization or validation steps for storyboard inputs are documented in the analyzed files.
Audit Metadata