motion-graphics

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes various system commands through the hyperframes CLI and local utility scripts. Specifically, grounding/locate.mjs uses ffmpeg and ffprobe to analyze images and draw localization grids. categories/maps/bake-basemap.mjs also uses ffmpeg to encode individual frames into MP4 video files. These operations are essential for the skill's primary function of video generation.- [EXTERNAL_DOWNLOADS]: Several components fetch resources from well-known external sources. The bake-basemap.mjs script downloads maplibre-gl, topojson-client, and world-atlas from cdn.jsdelivr.net. It also fetches map tiles from official ArcGIS and CartoDB endpoints. The circle-highlight template references the gsap animation library from cdn.jsdelivr.net. These are standard, reputable sources for web and mapping libraries.- [DYNAMIC_EXECUTION]: The geographic mapping module (bake-basemap.mjs) uses Puppeteer to launch a headless browser. It dynamically generates an HTML page containing JavaScript to render map imagery. The script uses the --no-sandbox flag to ensure compatibility in various environments, which is a standard approach for headless rendering tools.- [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as news articles, tweets, and web pages to generate animations. While this creates an attack surface for indirect prompt injection, the risk is mitigated by a structured pipeline where a Director agent converts the raw data into a strictly defined JSON-based shot plan before the Builder agent creates the final composition. This separation of concerns and use of intermediate representations provides a layer of sanitization against malicious instructions embedded in the source data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 06:31 PM