scenario-motion-loops
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
render-loop.mjsscript utilizeschild_process.spawnto runffmpegandffprobefor video encoding and metadata verification. It validates numeric inputs like frame rates, quality (CRF), and sampling counts to ensure they are finite numbers before passing them to the shell. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
playwrightpackage and the download of Chromium browser binaries to handle the rendering of Canvas animations. It also suggests downloading user assets viacurlinto the project directory. - [DYNAMIC_EXECUTION]: The rendering engine uses Playwright's
page.evaluateto execute the animation code within a headless browser context, which is the intended method for capturing frame data from the HTML templates. - [DATA_EXPOSURE]: The script implements a local HTTP server to serve files during the rendering process. It includes a security check to verify that all requested file paths are within the designated root directory, mitigating directory traversal risks.
Audit Metadata