vos-authoring
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches 3D assets such as fonts and HDR environment maps from well-known and trusted public repositories including jsDelivr and Polyhaven.
- [COMMAND_EXECUTION]: The skill uses standard package management (npm) and a specialized command-line interface (vos CLI) to compile, render, and preview animation configurations locally. These operations are restricted to the vendor's own toolset (@vosjs/core, @vosjs/cli).
- [DATA_EXFILTRATION]: Provides a mechanism to share animation configurations with the vendor's official hosting service (vos.so) via a POST request. This is a documented feature for sharing work without requiring an account and is consistent with the skill's purpose.
- [DYNAMIC_EXECUTION]: The animation engine uses JavaScript strings within JSON configurations for logic. The skill provides clear safety guidelines (e.g., no external imports, no non-deterministic functions) to ensure these scripts remain contained within the engine's context.
Audit Metadata