motion-canvas-agent
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill extracts and exposes text content from Motion Canvas scene nodes via the
/scene-graphendpoint. This data ingestion surface could be used to deliver instructions to an AI agent if project content is maliciously crafted.\n - Ingestion points: The
serializeNodefunction inassets/agent-client.tsreads thetextproperty of scene nodes.\n - Boundary markers: The
SKILL.mddocumentation notes that scene graph data should be treated as untrusted.\n - Capability inventory: The skill can write screenshots to the filesystem, trigger renders, and control the playback state.\n
- Sanitization:
assets/agent-client.tsstrips control characters and truncates extracted text to a maximum of 100 characters.\n- [COMMAND_EXECUTION]: The plugin implements an API that allows external programmatic control over the local Motion Canvas environment.\n - Evidence:
assets/agent-plugin.tsprovides multiple POST endpoints, such as/seek,/render, and/settings, which allow an agent to command the Motion Canvas player instance.
Audit Metadata