p5js
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSNO_CODE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the p5.js core library and its addons (p5.sound.js, p5.js-svg) from well-known and trusted CDNs including cdnjs.cloudflare.com and unpkg.com. These are standard practices for web-based development.
- [COMMAND_EXECUTION]: The skill includes shell scripts (
setup.sh,render.sh,serve.sh) that perform legitimate development operations: verifying system dependencies (Node.js, ffmpeg), running a local HTTP server using Python or Node.js to circumvent CORS issues when loading local assets, and orchestrating a media pipeline to convert frame sequences into MP4 videos using ffmpeg. These tools are standard in the creative coding ecosystem. - [REMOTE_CODE_EXECUTION]: While
render.shandexport-frames.jsinvolve executing code via Puppeteer and Node.js, this is done in a local, controlled environment for the purpose of high-resolution frame capture. The inputs are local HTML files generated by the user or agent, not untrusted remote scripts. - [NO_CODE]: The core generative art logic is not provided as pre-compiled binaries or complex scripts, but rather as human-readable templates and documentation to guide the AI agent in writing standard, browser-based JavaScript.
Audit Metadata