animate-skill
Pass
Audited by Gen Agent Trust Hub on Feb 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the use of
oanimandnpxCLI tools for core operations including project initialization, video rendering, and AI asset manipulation (image generation, background removal, and upscaling). These commands are standard for the intended development workflow.\n- [EXTERNAL_DOWNLOADS]: Dependencies are managed via NPM, primarily targeting the@oanimvendor scope and well-known repositories from theremotion-devorganization. Additionally, the skill interacts with theopen-animate.complatform andfal.aifor cloud-based rendering and AI model execution, which are documented features.\n- [PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection when processing user-defined prompts for AI image generation.\n - Ingestion points: CLI arguments provided to the
oanim assets gen-imageandedit-imagecommands as shown inreferences/asset-generation.md.\n - Boundary markers: No explicit delimiters or boundary markers are defined in the command templates to isolate user-supplied prompts from tool instructions.\n
- Capability inventory: The agent has access to local command execution (
oanim) and external asset generation APIs.\n - Sanitization: There is no documented input validation or sanitization for external content before it is passed to the generation models.
Audit Metadata