orca-motion
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
ffmpegfor video encoding, GIF generation, and thumbnail creation. These operations are performed viaexecFileSyncinscripts/capture.mjs,scripts/gallery.mjs, andscripts/build-site.mjs. The commands operate on local files and are essential to the primary function of converting animations to video. - [EXTERNAL_DOWNLOADS]: The skill depends on standard Node.js packages
gsapandplaywright-core. Thescripts/capture.mjsscript automates a local browser instance (Google Chrome) to capture animation frames, which is standard behavior for web-based rendering tools. - [INDIRECT_PROMPT_INJECTION]: The animation runtime in
runtime/motion.jsparses JSON data provided within the animation scenes to define values for charts, labels, and timing. While this represents a surface for untrusted data ingestion, the execution is confined to a local rendering context for the purpose of generating visual output. - [SAFE]: The skill references a sibling project
orca-transition-skill, which is a vendor-owned resource by the same author (zhenwusw). It also utilizes Google Analytics for its public gallery site, which is a well-known service. All external resources and scripts align with the developer's infrastructure and the skill's creative purpose.
Audit Metadata