maps-and-data-motion

Pass

Audited by Gen Agent Trust Hub on Nov 1, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and visualize user-provided data, such as location names, statistics, and numeric values. These data points are interpolated into HTML/SVG templates (e.g., compositions/stat.html and compositions/route.html) which could represent an injection surface if the input data were to contain malicious script content, although the current implementation focuses on standard data types.
  • [COMMAND_EXECUTION]: The skill's demo asset pipeline includes a TypeScript tool (analyze-audio.ts) and a shell script (make-beat.sh) that use ffmpeg to synthesize and analyze audio for the visualizers. These operations are local and perform intended asset-processing tasks.
  • [EXTERNAL_DOWNLOADS]: The animation templates load the GSAP animation engine from a well-known public CDN (jsDelivr) and retrieve registry information from the official HyperFrames repository on GitHub.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 1, 2026, 12:01 PM