reanimate
A Claude Code skill that clones an animation, widget or section from a reference (a live URL, video, gif, Lottie or prototype export) into the user's codebase. It then records the clone and compares it frame by frame against the reference, iterating until timing, easing, sequence and layout match.
What it can touch
| files | write |
|---|---|
| network | bun.sh, clerk.com, github.com, godotshaders.com, iquilezles.org, liveblocks.io, nextjs.org, pro.reactbits.dev, resend.com, skills.sh, stackoverflow.com, stripe.com, thebookofshaders.com, turborepo.com, vercel.com, workos.com, www.researchgate.net, www.shadertoy.com, xxhash.com |
| shell | runs commands |
| secrets | none found |
What it actually does
SKILL.md and its reference docs direct the agent through a workflow. The agent runs a setup script that installs Playwright, a static ffmpeg and pixelmatch through Bun. It captures the reference with headless Chromium, using bun scripts (capture.ts, frames.ts, sheet.ts, compare.ts, easing.ts, gl.ts). It writes a motion spec and capture artefacts under .reanimate/<name>/ in the user's project, edits or creates the user's component files, captures the clone the same way and compares the two. The bundle also contains the author's marketing site: a Next.js static site deployed to Cloudflare, with hand-ported example widgets cloned from clerk.com, stripe.com, resend.com and others, plus fonts with OFL licences. None of the visible files read credentials, contact hidden hosts, persist themselves or change agent configuration. The executable scripts that do the actual work (setup.sh, capture.ts, inpage/clock.js, inpage/gl-hooks.js, etc.) were left out of the bundle and could not be inspected.
What the check found
mediumHas a hidden comment that speaks to the agent
HTML comments don't show when Markdown is displayed, but agents read them.
site/AGENTS.md:1 <!-- BEGIN:nextjs-agent-rules -->
site/AGENTS.md:9 <!-- END:nextjs-agent-rules -->
mediumContains invisible characters
Zero-width and other invisible characters can hide words or split them so filters and reviewers miss them.
site/public/examples/clerk-bento/src/widgets/magic-links.js:436 this.email = el("div", "ml-email", `${user.email}@⟦U+2060⟧example.com`);
site/public/examples/clerk-bento/src/widgets/magic-links.js:452 setEmail(user) { this.user = user; this.email.textContent = `${user.email}@⟦U+2060⟧example.com`; }
mediumContains a long encoded blob
Long base64 or hex strings can hide code or data that a reader can't see.
site/public/examples/resend-cube/assets/scene.json:1 {"note":"Ported from the reanimate trace of https://resend.com/ (Spline scene /static/cube.splinecode, three.js r149).","camera":{"matrixWorld":[0.7071067811865
mediumSetup script downloads browsers and binaries; the executable scripts were not available for review
The workflow starts by running setup.sh, which installs npm packages and downloads Playwright's Chromium and a static ffmpeg binary. All the scripts the agent runs (setup.sh, capture.ts, compare.ts, gl.ts, inpage/clock.js, inpage/gl-hooks.js) were left out of this bundle, so it could not be confirmed that they do only what the docs describe. The declared dependencies in scripts/package.json are mainstream and pinned or ranged sensibly. A human should check the omitted scripts before listing.
skills/reanimate/SKILL.md:38 `<skill>` below is the directory this SKILL.md lives in. Scripts need [Bun](https://bun.sh); the first run downloads Playwright's Chromium and a static ffmpeg (
skills/reanimate/SKILL.md:41 bash <skill>/scripts/setup.sh # installs playwright, ffmpeg, pixelmatch once; prints "ready"
skills/reanimate/scripts/package.json:6 "ffmpeg-static": "^5.2.0",
mediumInstall script and all capture/compare executables were not available for review
The skill tells the agent to run a bash setup script and several bun TypeScript scripts. Those scripts download about 250 MB of browser and ffmpeg binaries and drive a headless browser. None of them were included in the bundle: - setup.sh, capture.ts, gl.ts, compare.ts, frames.ts, easing.ts, sheet.ts and lib.ts; - the in-page scripts clock.js and gl-hooks.js. The declared dependencies are plausible and mostly pinned: playwright 1.64.1, ffmpeg-static ^5.2.0, pixelmatch, pngjs. ffmpeg-static fetches a binary at install time. Nothing visible is malicious, but the code that actually runs on the user's machine could not be inspected. A person should read setup.sh and the scripts before listing.
skills/reanimate/SKILL.md:41 bash <skill>/scripts/setup.sh # installs playwright, ffmpeg, pixelmatch once; prints "ready"
skills/reanimate/SKILL.md:38 `<skill>` below is the directory this SKILL.md lives in. Scripts need [Bun](https://bun.sh); the first run downloads Playwright's Chromium and a static ffmpeg (
skills/reanimate/scripts/package.json:6 "ffmpeg-static": "^5.2.0",
Keep an eye on it
This check is of one commit. Watch reanimate and we'll email you if a later commit changes what it can touch.
Made this? Add the badge
[](https://plugsday.com/tools/niazmorshed2007-reanimate)About this check
Checked November 2, 2026 at commit 3f7a55a2986a, 378 files. Rules for known red flags, then two Claude reviews, one of them told to assume the author is malicious. A later commit hasn't been checked. How checks work.