code-animation-prompts
A library of 341 style prompts and 193 reference stills for making code-driven animations (HTML/Canvas/SVG/Three.js) and optionally rendering them to video. It includes a style-search script, a starter template and a render helper.
What it can touch
| files | write, including ~/.claude/skills/code-animation-prompts, ~/.agents/skills/code-animation-prompts |
|---|---|
| network | catalog.archives.gov, commons.wikimedia.org, ffmpeg.org, github.com, images.nasa.gov, prompt-motion.com, s3-us-west-2.amazonaws.com |
| shell | runs commands |
| secrets | none found |
What it actually does
Most of the visible bundle is passive content: Markdown style prompts, reference Canvas 2D code snippets, example write-ups and MIT license files for third-party sources. SKILL.md tells the agent to run the bundled `scripts/styles.py` to search the catalog and, when the user wants MP4, to run `scripts/render_video.py`. A separate one-click-import prompt tells an agent to clone the GitHub repo and run `scripts/install_skill.py` to install the skill into ~/.claude/skills or ~/.agents/skills. Several third-party style prompts (L-series, M19) are instructions to an agent: download open data, footage or a ~970 MB matting model, install packages into a project venv, and search the web. Those prompts reference demo/ engine files that are not in this bundle. The executable files (styles.py, render_video.py, install_skill.py, build/validate scripts, the starter HTML, _公共函数.js, the picker HTML) were omitted from the bundle, so their behavior could not be checked. No hidden Unicode, prompt injection or credential access appears in the visible files.
What the check found
mediumOne-click import has the agent clone a repo and run an unreviewed install script into the agent's skills folder
The copy-paste prompt tells an agent with terminal access to download the GitHub repo and run scripts/install_skill.py, which writes into ~/.claude/skills or ~/.agents/skills. The prompt is user-initiated and is careful: it says not to overwrite existing folders and not to modify other assistant config. However, install_skill.py was not included in the bundle, so what it actually writes could not be verified.
prompts/one-click-import.md:12 在仓库根目录运行 python scripts/install_skill.py --target codex 或 --target claude。
prompts/one-click-import.md:11 Claude Code 使用 ~/.claude/skills/code-animation-prompts。
mediumSkill instructs running bundled Python scripts whose source was not reviewable
SKILL.md has the agent execute scripts/styles.py for search and scripts/render_video.py for rendering. Both are expected for the stated purpose, but neither file was included, so their behavior is unverified.
skills/code-animation-prompts/SKILL.md:15 python "<技能目录>/scripts/styles.py" search 水墨
skills/code-animation-prompts/SKILL.md:45 用户要 MP4 时，实际渲染并检查分辨率、时长、帧率和声音轨。可使用随附的 `scripts/render_video.py`，接口和依赖见渲染说明。若缺少渲染依赖，交付已完成的 HTML、源码与准确的运行命令，并明确视频尚未导出；不能把 HTML 或录屏命令当成成片。
mediumAgent is told to run bundled Python scripts that were not available for review
SKILL.md has the agent run scripts/styles.py and scripts/render_video.py. Neither script, nor install_skill.py, was in the bundle, so what they actually execute could not be checked. A malicious payload would most likely sit in these scripts. A person should read them before the tool is listed.
skills/code-animation-prompts/SKILL.md:15 python "<技能目录>/scripts/styles.py" search 水墨
skills/code-animation-prompts/SKILL.md:45 用户要 MP4 时，实际渲染并检查分辨率、时长、帧率和声音轨。可使用随附的 `scripts/render_video.py`，接口和依赖见渲染说明。若缺少渲染依赖，交付已完成的 HTML、源码与准确的运行命令，并明确视频尚未导出；不能把 HTML 或录屏命令当成成片。
mediumOne-click import downloads an unpinned repo and runs its installer into the agent's skills folder
The user pastes this prompt deliberately, and it is scoped: it says not to overwrite existing folders and not to change other assistants' config. Still, it fetches the current HEAD of a GitHub repo and runs install_skill.py, which was not reviewed, writing into ~/.claude/skills. Later repo changes would be installed without any review.
prompts/one-click-import.md:6 请将 https://github.com/XiaoyeCodes/code-animation-prompts 安装为当前编程助手可用的 skill。
prompts/one-click-import.md:12 在仓库根目录运行 python scripts/install_skill.py --target codex 或 --target claude。
Keep an eye on it
This check is of one commit. Watch code-animation-prompts and we'll email you if a later commit changes what it can touch.
Made this? Add the badge
[](https://plugsday.com/tools/xiaoyecodes-code-animation-prompts)About this check
Checked November 2, 2026 at commit 69ccbeaf0b82, 581 files. Rules for known red flags, then two Claude reviews, one of them told to assume the author is malicious. A later commit hasn't been checked. How checks work.