iart-ai/motion-design-skills

No problems traced to this repository code in these checks.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The README install command installs the motion design skills into the project: Real input produced the expected result: Installed 9 skills

  Source: npx skills add iart-ai/motion-design-skills

  Input: npx skills add iart-ai/motion-design-skills -y --agent claude-code, run in an empty project directory outside the checkout

  Expected: Installer reports 9 skills installed

  Command: npx -y skills add iart-ai/motion-design-skills -y --agent claude-code

  Observed: Installed 9 skills ────────────────────────╮ │ │ │ ✓ after-effects (copied) │ │ → ./.claude/skills/after-effects │ │ ✓ animation-principles (copied) │ │ → ./.claude/skills/animation-principles │ │ ✓ beat-sync-editing (copied) │ │ → ./.claude/skills/beat-sync-editing │ │ ✓ color-motion (copied) │ │ → ./.claude/skills/color-motion │ │ ✓ logo-animation (copied) │ │ → ./.claude/skills/logo-animation │ │ ✓ motion-art-direction (

Examples

• Contact sheet tiles start, mid and end frames side-by-side for one-glance review: command completed successfully

  Source: scripts/README.md

  Input: 3 PNG frames from /tmp/motion-testdata tiled into one sheet

  Expected: sheet.png written with 3 frames

  Command: scripts/contact-sheet.sh /tmp/motion-out/examples/sheet.png /tmp/motion-testdata/frame-0.png /tmp/motion-testdata/frame-1.png /tmp/motion-testdata/frame-2.png

  Observed: ✓ contact sheet (3 frame(s)) → /tmp/motion-out/examples/sheet.png

• probe-mp4.sh reads and asserts the MP4 real resolution, codec, fps and duration: command completed successfully

  Source: scripts/README.md

  Input: /tmp/motion-testdata/short.mp4 asserted as 1080x1920 at 30 fps

  Expected: spec printed and OK

  Command: scripts/probe-mp4.sh /tmp/motion-testdata/short.mp4 1080x1920 30

  Observed: short.mp4: 1080x1920 h264 30 fps 2.00s ✓ spec OK

• seek-shot.sh freezes an HTML animation at given times and screenshots each frame: Requires npx Playwright Chromium (npx playwright install chromium), which must be downloaded; browser download is not permitted in this guest and the shared CDP endpoint is not used by the script. Not run. Local Chromium check: no chromium/google-chrome binary found on PATH.

  Source: scripts/README.md

  Expected: documented command completes successfully

  Observed: Requires npx Playwright Chromium (npx playwright install chromium), which must be downloaded; browser download is not permitted in this guest and the shared CDP endpoint is not used by the script. Not run. Local Chromium check: no chromium/google-chrome binary found on PATH.

Local or hosted: local

Install the motion design skills with the README installer, then run the bundled verify-loop scripts (probe-mp4.sh asserts an MP4 spec; contact-sheet.sh tiles frames into one image)

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; cat /etc/os-release | head -2; python3 --version
cd <guest-path> && find . -maxdepth 2 -not -path './.git*' | head -100 && echo --- && cat README.md 2>/dev/null | head -150
cd <guest-path> && cat scripts/README.md; echo ---; ls -la .coldpass scripts; echo ---; cat .claude-plugin/plugin.json; echo; ls <guest-path> 2>&1; ls /inputs 2>&1
cd <guest-path> && head -c 2500 scripts/probe-mp4.sh; echo; echo ---; head -c 2000 scripts/seek-shot.sh; echo; echo ---; head -c 2000 scripts/contact-sheet.sh; echo; echo ---; which ffmpeg ffprobe node npm npx; echo "CDP=$CDP_URL"
curl -sS -m 10 -i "$CDP_URL/json/version"; echo; echo "exit=$?"; which ffmpeg ffprobe; node --version; npm --version; ls -la <guest-path>; head -c 1500 <guest-path>
sudo -n true && echo SUDO_OK; sudo apt-get -o DPkg::Lock::Timeout=300 update -qq 2>&1 | tail -3; sudo apt-get -o DPkg::Lock::Timeout=300 install -y -qq ffmpeg 2>&1 | tail -3; which ffmpeg ffprobe && ffmpeg -version | head -1
cd /tmp && export NODE_USE_ENV_PROXY=1 && timeout 120 npm view skills version 2>&1 | tail -3; echo "exit=$?"; timeout 20 curl -sSI https://github.com 2>&1 | head -1
mkdir -p /tmp/skills-install && cd /tmp/skills-install && export NODE_USE_ENV_PROXY=1 DO_NOT_TRACK=1 DISABLE_TELEMETRY=1 && timeout 280 npx -y skills add iart-ai/motion-design-skills -y --agent claude-code 2>&1 | tail -30; echo "exit=${PIPESTATUS[0]}"; find /tmp/skills-install -maxdepth 4 | head -40
mkdir -p /tmp/motion-testdata && cd /tmp/motion-testdata && ffmpeg -v error -y -f lavfi -i testsrc=size=1080x1920:rate=30 -t 2 -c:v libx264 -pix_fmt yuv420p short.mp4 && for t in 0 1 2; do ffmpeg -v error -y -f lavfi -i "color=c=0x1f6feb:s=540x960:d=1" -vf "drawtext=fontfile=/usr/share/fonts/truetype/dejavu/DejaVuSans.ttf:text='t=$t':fontcolor=white:fontsize=96:x=100:y=400" -frames:v 1 frame-$t.png 2>/dev/null || ffmpeg -v error -y -f lavfi -i "color=c=0x1f6feb:s=540x960:d=1" -frames:v 1 frame-$t.png; done; ls -la; ls /tmp/motion-out 2>&1
cd <guest-path> && scripts/probe-mp4.sh /tmp/motion-testdata/short.mp4 1080x1920 30; echo "exit=$?"; scripts/probe-mp4.sh /tmp/motion-testdata/short.mp4 1920x1080 30; echo "exit=$?"
mkdir -p /tmp/motion-out && cd <guest-path> && scripts/contact-sheet.sh /tmp/motion-out/sheet.png /tmp/motion-testdata/frame-0.png /tmp/motion-testdata/frame-1.png /tmp/motion-testdata/frame-2.png; echo "exit=$?"; ls -la /tmp/motion-out
cd <guest-path> && grep -rniE "cron|schedul|--once|--now|setInterval|watch|webhook|loop" --include=*.sh --include=*.md --include=*.json --include=*.html . | grep -v showcase | head -20; echo ---; which chromium chromium-browser google-chrome 2>&1 | head -3; echo ---; rm -f /tmp/motion-out/sheet.png && rmdir /tmp/motion-out && mkdir -p /tmp/motion-out/probe /tmp/motion-out/examples /tmp/skills-claim && ls -la /tmp/motion-out /tmp/skills-claim
cd <guest-path> && cat > .coldpass/claims.json <<'EOF'
[
  {
    "kind": "claim",
    "claim": "The README install command installs the motion design skills into the project",
    "source": "npx skills add iart-ai/motion-design-skills",
    "input": "npx skills add iart-ai/motion-design-skills -y --agent claude-code, run in an empty project directory outside the checkout",
    "expected": "Installer reports 9 skills installed",
    "probe_kind": "cli",
    "argv": ["npx", "-y", "skills", "add", "iart-ai/motion-design-skills", "-y", "--agent", "claude-code"],
    "cwd": "/tmp/skills-claim",
    "env": {"NODE_USE_ENV_PROXY": "1", "DO_NOT_TRACK": "1", "DISABLE_TELEMETRY": "1"},
    "expected_text": "Installed 9 skills"
  }
]
EOF
python3 -I -c "import json;print(len(json.load(open('.coldpass/claims.json'))))"
cd <guest-path> && cat > .coldpass/probe.json <<'EOF'
{
  "kind": "cli",
  "argv": ["scripts/probe-mp4.sh", "/tmp/motion-testdata/short.mp4", "1080x1920", "30"],
  "cwd": "<guest-path>",
  "expected_text": "spec OK"
}
EOF
cat > .coldpass/examples.json <<'EOF'
[
  {
    "kind": "example",
    "claim": "Contact sheet tiles start, mid and end frames side-by-side for one-glance review",
    "source": "scripts/README.md",
    "input": "3 PNG frames from /tmp/motion-testdata tiled into one sheet",
    "expected": "sheet.png written with 3 frames",
    "argv": ["scripts/contact-sheet.sh", "/tmp/motion-out/examples/sheet.png", "/tmp/motion-testdata/frame-0.png", "/tmp/motion-testdata/frame-1.png", "/tmp/motion-testdata/frame-2.png"],
    "cwd": "<guest-path>",
    "expected_file": "/tmp/motion-out/examples/sheet.png",
    "expected_text": "contact sheet (3 frame(s))"
  },
  {
    "kind": "example",
    "claim": "probe-mp4.sh reads and asserts the MP4 real resolution, codec, fps and duration",
    "source": "scripts/README.md",
    "input": "/tmp/motion-testdata/short.mp4 asserted as 1080x1920 at 30 fps",
    "expected": "spec printed and OK",
    "argv": ["scripts/probe-mp4.sh", "/tmp/motion-testdata/short.mp4", "1080x1920", "30"],
    "cwd": "<guest-path>",
    "expected_text": "spec OK"
  },
  {
    "kind": "example",
    "claim": "seek-shot.sh freezes an HTML animation at given times and screenshots each frame",
    "source": "scripts/README.md",
    "reason": "Requires npx Playwright Chromium (npx playwright install chromium), which must be downloaded; browser download is not permitted in this guest and the shared CDP endpoint is not used by the script. Not run. Local Chromium check: no chromium/google-chrome binary found on PATH."
  }
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected": false, "reason": "Entry points inspected: README.md, scripts/README.md, scripts/seek-shot.sh, scripts/contact-sheet.sh, scripts/probe-mp4.sh, .claude-plugin/plugin.json. No cron, scheduler, daemon, --once/--now, webhook or loop trigger in product code; the only matches for loop/watch are animation content inside skill markdown. The scripts are one-shot tools run by the agent.", "checks": []}
EOF
for f in probe examples cycles claims; do python3 -I -c "import json,sys;json.load(open('.coldpass/$f.json'));print('$f ok')"; done
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && scripts/contact-sheet.sh /tmp/motion-out/examples/sheet.png-checker-test /tmp/motion-testdata/frame-0.png /tmp/motion-testdata/frame-1.png /tmp/motion-testdata/frame-2.png; echo "exit=$?"; ls /tmp/motion-out/examples/; echo ---; ls /tmp/motion-out/examples/ ; scripts/contact-sheet.sh /tmp/motion-out/examples/sheet.png /tmp/motion-testdata/frame-0.png /tmp/motion-testdata/frame-1.png /tmp/motion-testdata/frame-2.png; echo "exit=$?"; ls /tmp/motion-out/examples/
grep -n "checker-" <guest-path> | head; grep -n "def fresh\|def _fresh\|suffix" <guest-path> | head -20
sed -n 785,830p <guest-path>
cd <guest-path> && python3 -I - <<'EOF'
import json
p='.coldpass/examples.json'
d=json.load(open(p))
for e in d:
    e.pop('expected_file',None)
json.dump(d,open(p,'w'),indent=2)
open(p,'a').write('\n')
print('ok', len(d))
EOF
rm -f /tmp/motion-out/examples/sheet.png && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "exit=$?"; python3 -I -c "
import json,re
t=open('<guest-path>').read()
d=json.loads(t[t.index('{'):])
print('valid',d.get('valid'),'problems',d.get('problems'))
r=d.get('replay',{})
print('replay',r.get('status'), r.get('details',{}).get('working'))
for c in r.get('details',{}).get('claims',[]): print('claim',c.get('verdict'),c.get('outcome'))
for c in r.get('details',{}).get('example_checks',[]): print('ex',c.get('verdict'),c.get('outcome'))
"
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{
  "outcome": "working",
  "fault_owner": null,
  "operation": "Install the motion design skills with the README installer, then run the bundled verify-loop scripts (probe-mp4.sh asserts an MP4 spec; contact-sheet.sh tiles frames into one image)",
  "operation_scope": "Linux Ubuntu 24.04, Node v22.23.4, npm 10.9.9, Python 3.12.3, ffmpeg/ffprobe 6.1.1 (apt). Test media generated locally in /tmp/motion-testdata. seek-shot.sh (Playwright Chromium) not run: needs a browser download, which is not permitted; the shared CDP endpoint is not used by that script.",
  "steps": [
    "curl -sS -m 10 -i $CDP_URL/json/version -> HTTP/1.1 200 OK (Chrome/155.0.8059.84)",
    "sudo apt-get -o DPkg::Lock::Timeout=300 install -y ffmpeg",
    "cd /tmp/skills-install && npx -y skills add iart-ai/motion-design-skills -y --agent claude-code  (README: npx skills add iart-ai/motion-design-skills) -> Installed 9 skills",
    "scripts/probe-mp4.sh /tmp/motion-testdata/short.mp4 1080x1920 30 -> 1080x1920 h264 30 fps 2.00s, spec OK",
    "scripts/contact-sheet.sh /tmp/motion-out/sheet.png frame-0.png frame-1.png frame-2.png -> contact sheet (3 frame(s)) written",
    "Negative check: scripts/probe-mp4.sh short.mp4 1920x1080 30 -> resolution mismatch reported, exit 1 (as designed)",
    "<env-var>=<guest-path> python3 -I <guest-path> --validate --replay -> valid true, no problems, replay PASS"
  ],
  "deviations": [
    "/inputs/coldpass-preflight.py does not exist in this guest; used <guest-path> as the task specified.",
    "ffmpeg was not preinstalled; installed Ubuntu ffmpeg 6.1.1 via apt-get (prerequisite for the scripts).",
    "The README installer creates ./.claude/skills in the directory it runs from; it was run in /tmp/skills-install so the checkout stays unmodified. The checkout was not changed.",
    "The first replay failed because the checker appends a -checker-<id> suffix to the example's output path, and contact-sheet.sh picks the output format from the file extension (ffmpeg exit 234 on '...sheet.png-checker-...'). This is a harness/path-naming conflict, not a product result. Fix: the example no longer declares expected_file; contact-sheet.sh overwrites its output, so replay still runs and the printed text is checked. The product still fails with non-standard output names, which the script could guard against (e.g. ffmpeg -f image2 or explicit format).",
    "seek-shot.sh was not run: it needs npx Playwright Chromium (npx playwright install chromium), which is a browser download and is not allowed here. It is recorded as a blocked example with its reason.",
    "The claim exercises the installer with extra flags (-y --agent claude-code) beyond the README's bare command, to make it non-interactive."
  ],
  "stuck_step": null,
  "main_blocker": null,
  "plain_failure": null,
  "suggested_fix": "None required for the working path. Optional: make scripts/contact-sheet.sh pass an explicit output format so it works with any output filename; and document that seek-shot.sh needs a locally installed Chromium."
}
EOF
python3 -I -c "import json;d=json.load(open('.coldpass/report.json'));print(d['outcome'], d['fault_owner'])"; ls -la .coldpass; ls <guest-path> | head -20
cd <guest-path> && rm -f /tmp/motion-out/examples/sheet.png && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "exit=$?"; python3 -I -c "
t=open('<guest-path>').read(); d=json.loads(t[t.index('{'):]) if False else None
import json; d=json.loads(t[t.index('{'):]); print('valid',d['valid'],'problems',d['problems'],'replay',d['replay']['status'])"