motion-graphics
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of system utilities and CLI tools to process media and manage project state.
- Uses
ffmpegandffprobeto encode video frames, extract metadata, and probe image dimensions across multiple scripts likegrounding/locate.mjsandcategories/maps/bake-basemap.mjs. - Employs
npx hyperframescommands for project initialization, component updates, and rendering management as part of the core vendor workflow. - Executes the
base64system utility to prepare image data for external API requests. - [EXTERNAL_DOWNLOADS]: The skill fetches necessary assets and dependencies from established, well-known providers.
- Downloads essential JavaScript animation and mapping libraries (GSAP, MapLibre, TopoJSON) from the
cdn.jsdelivr.netcontent delivery network. - Retrieves raster map tiles from industry-standard services including Esri (
server.arcgisonline.com) and CARTO (basemaps.cartocdn.com). - Interfaces with the Google Generative Language API for object localization tasks when a user-provided API key is present.
- [DYNAMIC_EXECUTION]: The skill generates and runs code within an isolated browser context for rendering purposes.
- The
categories/maps/bake-basemap.mjsscript constructs dynamic HTML/JavaScript environments to drive the MapLibre engine via Puppeteer, ensuring deterministic and offline-reproducible map bakes. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data that could contain untrusted instructions, although risks are mitigated by its structured workflow.
- Ingestion points: The skill captures data from external URLs and news articles via the
hyperframes capturetool and subagent searches. - Boundary markers: Instructions designate subagents (
Director,Builder) to transform raw input into structured JSON plans (shot-plan.json) before final interpolation into the rendering pipeline. - Capability inventory: The execution environment includes capabilities for network requests, file system modifications, and subprocess execution.
- Sanitization: Untrusted data is processed through vendor-specific capture tools designed to extract structural metadata rather than raw executable content.
Audit Metadata