motion-graphics

Pass

Audited by Gen Agent Trust Hub on Nov 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of system utilities and CLI tools to process media and manage project state.
  • Uses ffmpeg and ffprobe to encode video frames, extract metadata, and probe image dimensions across multiple scripts like grounding/locate.mjs and categories/maps/bake-basemap.mjs.
  • Employs npx hyperframes commands for project initialization, component updates, and rendering management as part of the core vendor workflow.
  • Executes the base64 system utility to prepare image data for external API requests.
  • [EXTERNAL_DOWNLOADS]: The skill fetches necessary assets and dependencies from established, well-known providers.
  • Downloads essential JavaScript animation and mapping libraries (GSAP, MapLibre, TopoJSON) from the cdn.jsdelivr.net content delivery network.
  • Retrieves raster map tiles from industry-standard services including Esri (server.arcgisonline.com) and CARTO (basemaps.cartocdn.com).
  • Interfaces with the Google Generative Language API for object localization tasks when a user-provided API key is present.
  • [DYNAMIC_EXECUTION]: The skill generates and runs code within an isolated browser context for rendering purposes.
  • The categories/maps/bake-basemap.mjs script constructs dynamic HTML/JavaScript environments to drive the MapLibre engine via Puppeteer, ensuring deterministic and offline-reproducible map bakes.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data that could contain untrusted instructions, although risks are mitigated by its structured workflow.
  • Ingestion points: The skill captures data from external URLs and news articles via the hyperframes capture tool and subagent searches.
  • Boundary markers: Instructions designate subagents (Director, Builder) to transform raw input into structured JSON plans (shot-plan.json) before final interpolation into the rendering pipeline.
  • Capability inventory: The execution environment includes capabilities for network requests, file system modifications, and subprocess execution.
  • Sanitization: Untrusted data is processed through vendor-specific capture tools designed to extract structural metadata rather than raw executable content.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 6, 2026, 02:06 PM