motion-graphics
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill's primary workflow involves the agent writing JavaScript, HTML, and CSS code which is subsequently executed via Node.js or Playwright to render video frames. While this is the intended purpose, it establishes a dynamic code execution surface.
- [INDIRECT_PROMPT_INJECTION]: The agent is instructed to crawl and inspect external product websites and repositories to extract branding, styles, and UI components. Ingesting this untrusted external data into the agent's context presents a surface for indirect prompt injection.
- [EXTERNAL_DOWNLOADS]: The skill automates the retrieval of assets (icons and favicons) from external domains and CDNs such as simpleicons.org. These downloads are performed to support the motion graphics creation process.
- [COMMAND_EXECUTION]: The skill includes internal utility scripts that use system binaries like ffmpeg and ffprobe to analyze video files and synthesize audio. These operations involve executing shell commands based on file paths within the project workspace.
Audit Metadata