maps-and-data-motion
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and visualize user-provided data, such as location names, statistics, and numeric values. These data points are interpolated into HTML/SVG templates (e.g.,
compositions/stat.htmlandcompositions/route.html) which could represent an injection surface if the input data were to contain malicious script content, although the current implementation focuses on standard data types. - [COMMAND_EXECUTION]: The skill's demo asset pipeline includes a TypeScript tool (
analyze-audio.ts) and a shell script (make-beat.sh) that useffmpegto synthesize and analyze audio for the visualizers. These operations are local and perform intended asset-processing tasks. - [EXTERNAL_DOWNLOADS]: The animation templates load the GSAP animation engine from a well-known public CDN (jsDelivr) and retrieve registry information from the official HyperFrames repository on GitHub.
Audit Metadata