cartoon-3d-short
Guides an agent through producing a 55-70 s vertical cartoon story short in a '2D cartoon characters in a 3D toon world' style, rendered with three.js inside Remotion. It includes synthesized SFX and march music, and uses the finished 'The Bridge That Fell for a Song' project as a template.
What it can touch
| files | write |
|---|---|
| network | none found |
| shell | runs commands |
| secrets | none found |
What it actually does
The bundle is a long production playbook (SKILL.md) plus reference style reports, TypeScript/GLSL rendering templates, and Python audio-synthesis and helper scripts. It directs the agent to: - copy the template into the user's Remotion project and edit source files; - run Remotion renders, node and python helper scripts, ffmpeg muxing and tsc; - spawn and coordinate verifier sub-agents; - set TEMP/TMP to a large drive and clean up old Remotion bundle and Chrome-profile folders when a project is finished; - deliver the final mp4 to the user. The visible code only does local work: rendering, DSP and WAV I/O, and file copy/backup. It has no network calls, no credential access, no hidden instructions and no persistence. The bundle also ships about 58 frames and contact sheets taken from a third-party channel's videos, which the skill itself labels as private study material that must never be sent or published.
What the check found
mediumBundle redistributes frames from a third-party channel it says must stay private
The skill describes its reference material as a channel studied privately and tells the agent never to upload, publish or send it. Yet the bundle itself ships references/frames/*.jpg and references/sheets/*.jpg extracted from that channel's videos. Listing it on a public directory would redistribute third-party copyrighted imagery. This is not malicious toward the user, but a person should decide whether those files may be distributed.
SKILL.md:13 The style reference is a channel studied privately (`references/`: STYLE_BIBLE.md, reports/*.md, frames/).
SKILL.md:14 - Those videos are private study material. Never upload, publish or send them.
references/reports/CONTEXT.md:12 ## Reference material (private study only: never upload, publish or send any of it anywhere)
mediumAgent is told to run scripts that were not available for review
The pipeline has the agent execute node and python helper scripts and render the TypeScript sources. bridge-stills.mjs, short_qa.py, sbs_sheet.py, the omitted audio scripts and almost all of templates/bridge/*.ts were left out of the bundle, so their behaviour is unverified. The visible code is clean, but a person should inspect these files before listing.
SKILL.md:71 9. **Look checks.** Run `node scripts/bridge-stills.mjs out/<name>/x_ 100,400 0.5`.
SKILL.md:78 - QA: `python scripts/short_qa.py final.mp4 out/<name>/qa shots.json` checks every frame for black, white, frozen and pop frames, plus loudness and sheets.
SKILL.md:73 - Make side-by-sides against reference frames with `python scripts/sbs_sheet.py out.jpg --ours ... --ref ...`.
mediumBundles and relies on a third-party channel's copyrighted material
The skill is built on a private study of another creator's 20 shorts: downloaded videos, transcripts, and frames and contact sheets that ship in this bundle under references/frames and references/sheets. It tells the agent to keep the source secret. This is not a security threat to the user, but distributing those frames is an IP and licensing concern for a public listing.
SKILL.md:13 The style reference is a channel studied privately (`references/`: STYLE_BIBLE.md, reports/*.md, frames/).
SKILL.md:16 - Never say the channel's name in a voice-over or description.
references/STYLE_BIBLE.md:2 Private study only. Videos: vids/ (720p, original EN audio), transcripts: tx/, per-video measurements: measure/summary.json,
Keep an eye on it
This check is of one commit. Watch cartoon-3d-short and we'll email you if a later commit changes what it can touch.
Made this? Add the badge
[](https://plugsday.com/tools/mromidev-claude-animated-shorts)About this check
Checked November 2, 2026 at commit e3b817b6afc6, 98 files. Rules for known red flags, then two Claude reviews, one of them told to assume the author is malicious. A later commit hasn't been checked. How checks work.