scenario-motion-loops

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The render-loop.mjs script utilizes child_process.spawn to run ffmpeg and ffprobe for video encoding and metadata verification. It validates numeric inputs like frame rates, quality (CRF), and sampling counts to ensure they are finite numbers before passing them to the shell.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the playwright package and the download of Chromium browser binaries to handle the rendering of Canvas animations. It also suggests downloading user assets via curl into the project directory.
  • [DYNAMIC_EXECUTION]: The rendering engine uses Playwright's page.evaluate to execute the animation code within a headless browser context, which is the intended method for capturing frame data from the HTML templates.
  • [DATA_EXPOSURE]: The script implements a local HTTP server to serve files during the rendering process. It includes a security check to verify that all requested file paths are within the designated root directory, mitigating directory traversal risks.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 02:42 PM