skills/tt-a1i/hermes-agent/p5js/Gen Agent Trust Hub

p5js

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSNO_CODE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches the p5.js core library and its addons (p5.sound.js, p5.js-svg) from well-known and trusted CDNs including cdnjs.cloudflare.com and unpkg.com. These are standard practices for web-based development.
  • [COMMAND_EXECUTION]: The skill includes shell scripts (setup.sh, render.sh, serve.sh) that perform legitimate development operations: verifying system dependencies (Node.js, ffmpeg), running a local HTTP server using Python or Node.js to circumvent CORS issues when loading local assets, and orchestrating a media pipeline to convert frame sequences into MP4 videos using ffmpeg. These tools are standard in the creative coding ecosystem.
  • [REMOTE_CODE_EXECUTION]: While render.sh and export-frames.js involve executing code via Puppeteer and Node.js, this is done in a local, controlled environment for the purpose of high-resolution frame capture. The inputs are local HTML files generated by the user or agent, not untrusted remote scripts.
  • [NO_CODE]: The core generative art logic is not provided as pre-compiled binaries or complex scripts, but rather as human-readable templates and documentation to guide the AI agent in writing standard, browser-based JavaScript.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 12:47 PM
Security Audit — agent-trust-hub — p5js