orca-motion

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes ffmpeg for video encoding, GIF generation, and thumbnail creation. These operations are performed via execFileSync in scripts/capture.mjs, scripts/gallery.mjs, and scripts/build-site.mjs. The commands operate on local files and are essential to the primary function of converting animations to video.
  • [EXTERNAL_DOWNLOADS]: The skill depends on standard Node.js packages gsap and playwright-core. The scripts/capture.mjs script automates a local browser instance (Google Chrome) to capture animation frames, which is standard behavior for web-based rendering tools.
  • [INDIRECT_PROMPT_INJECTION]: The animation runtime in runtime/motion.js parses JSON data provided within the animation scenes to define values for charts, labels, and timing. While this represents a surface for untrusted data ingestion, the execution is confined to a local rendering context for the purpose of generating visual output.
  • [SAFE]: The skill references a sibling project orca-transition-skill, which is a vendor-owned resource by the same author (zhenwusw). It also utilizes Google Analytics for its public gallery site, which is a well-known service. All external resources and scripts align with the developer's infrastructure and the skill's creative purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 03:43 PM