rive
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [SAFE]: The skill's primary content consists of structured markdown documentation providing architectural and technical guidance for the Rive animation platform. No malicious instructions, obfuscation, or data exfiltration patterns were detected.
- [COMMAND_EXECUTION]: The package includes PowerShell maintenance scripts (
build-portable.ps1andvalidate-skill.ps1) used to bundle references and verify the integrity of documentation links. The documentation also provides CLI command examples for using the Rive Luau analyzer to validate scripts. - [EXTERNAL_DOWNLOADS]: The skill provides links to official documentation on
rive.appand references external developer tools (LSP and Animation Viewer) hosted on GitHub. These references are used for legitimate technical authoring and debugging workflows. - [INDIRECT_PROMPT_INJECTION]: The skill acknowledges an attack surface where untrusted data (Rive files or Luau scripts) might contain unexpected instructions. It mitigates this by instructing the agent to use specific verification labels (Verified, Inspected, Unverified) and to prioritize architectural inspection before performing mutations.
- [DYNAMIC_EXECUTION]: The skill provides guidance for authoring Luau scripts and shaders. It mentions the use of specialized Model Context Protocol (MCP) tools for runtime evaluation of these scripts within the Rive environment for debugging purposes.
Audit Metadata