uiux-motion-system
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Python script (scripts/motion_lint.py) and associated unit tests (scripts/tests/) that utilize subprocess.run to execute local Python commands. These are legitimate tools used for linting source code for motion-related risks and verifying the integrity of external snapshots included in the skill.
- [INDIRECT_PROMPT_INJECTION]: The motion_lint.py script processes user-provided source code files to surface motion-related patterns. This ingestion of external data represents a potential attack surface for indirect prompt injection, although the instructions specify that findings should be treated as prompts for human review rather than absolute instructions.
- [EXTERNAL_DOWNLOADS]: The skill contains references to official documentation and repositories from well-known and trusted organizations, including LottieFiles and GreenSock (GSAP). These references are used for implementation guidance and do not involve the execution of untrusted remote code.
Audit Metadata