Skills
Navigate
skills/sergeyramas/3d-animation-creator-skill/3d-animation-creator/Gen Agent Trust Hub

3d-animation-creator

Fail

Audited by Gen Agent Trust Hub on Jun 6, 2026

Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses system tools including ffmpeg and ffprobe to process video files into individual frames. It also utilizes python3 to host a local web server for site previewing purposes.
  • [REMOTE_CODE_EXECUTION]: The documentation and installation instructions promote the use of a shell script hosted on the author's GitHub repository, executed via curl | bash. This script performs a git clone to install the skill.
  • [EXTERNAL_DOWNLOADS]: The skill's implementation guide includes a reference to the Three.js library hosted on the well-known Cloudflare CDNJS service for optional 3D particle effects.
  • [PROMPT_INJECTION]: The skill uses the WebFetch tool to extract content from user-provided URLs to populate the generated website sections. This creates a surface for indirect prompt injection where a malicious website could influence agent behavior.
  • Ingestion points: Content retrieved from external URLs via the WebFetch tool as described in SKILL.md.
  • Boundary markers: No specific delimiters or instructions to ignore embedded commands are present.
  • Capability inventory: Subprocess execution for video processing (ffmpeg), directory management, and local networking (python3).
  • Sanitization: The instructions do not specify any validation, escaping, or sanitization of the fetched external content before it is processed by the agent.
Recommendations
  • HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/sergeyramas/3d-animation-creator-skill/main/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Jun 6, 2026, 01:32 PM