motion-graphics

Pass

Audited by Gen Agent Trust Hub on Jul 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes system binaries including ffmpeg, ffprobe, and base64 for media processing and coordinate localization tasks.
  • [COMMAND_EXECUTION]: Uses npx to execute framework-specific tools like hyperframes for project initialization, rendering, and linting.
  • [COMMAND_EXECUTION]: Executes a headless Chrome browser via Puppeteer with the --no-sandbox flag to bake map imagery into deterministic video frames.
  • [EXTERNAL_DOWNLOADS]: Downloads geographic libraries and datasets from trusted sources such as Cloudflare (via jsDelivr) and public CDN repositories.
  • [EXTERNAL_DOWNLOADS]: Interacts with mapping services from well-known providers (Esri, CARTO) to fetch map tiles during the asset sourcing phase.
  • [EXTERNAL_DOWNLOADS]: Connects to Google's Gemini API for automated object detection in images when a valid API key is provided in the environment.
  • [SAFE]: Implements secure credential management by utilizing environment variables (GEMINI_API_KEY, GOOGLE_API_KEY) rather than hardcoding secrets.
  • [SAFE]: Employs a structured JSON intermediate representation (shot-plan.json) to manage data flow between planning and rendering phases, providing a clear boundary for untrusted data ingestion.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 4, 2026, 11:52 AM
Security Audit — agent-trust-hub — motion-graphics