C — Moderate risk signals Graded October 16, 2026Several concerns worth a closer look before you install.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
AI agent skill · Developer tools, Web & browsing
oil-motion
Web animation skill for Claude Code & Codex. 帮你做跟着滚动和鼠标动的网页动画。
Bottom line: Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code audit.
- Popularity score
- 39/100
- Rank
- #361 of 500
- GitHub stars
- 2.6k
What it does
oil-motion is a web animation skill that enables Claude Code & Codex to generate scroll-triggered and mouse-following animations for web pages. It simplifies creating interactive visual effects that respond to user input without requiring manual animation setup.
Who it’s for
Frontend developers and AI builders who want to quickly prototype or generate interactive web animations within Claude-based coding workflows. Best suited for projects prioritizing visual polish and user engagement over performance-critical applications.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/oil-oil/oil-motion (opens external site) for latest installation. Likely installation via npm:
npm install oil-motion
For Claude Desktop integration, add to mcpServers config (confirm exact schema in repo):
"oil-motion": {
"command": "node",
"args": ["path/to/oil-motion/server.js"]
}
Risks
- No npm download signals suggest minimal real-world adoption and limited security vetting by external auditors
- Animation code execution in browser context could be exploited via prompt injection to inject malicious JavaScript if Claude's output isn't properly sandboxed
- Repository appears to have limited maintenance signals (stars alone don't guarantee active security updates); dependency vulnerabilities may go unpatched
- Mouse and scroll event handlers access user interaction data; unclear if this data is logged or exfiltrated by the library
- Single-author/small-team supply chain risk with no evidence of security policy or responsible disclosure process
How to stay secure
Security Hardening Guide: oil-motion
Least-privilege permissions
- Limit to animation-only use cases: Only use oil-motion for visual effects (scrolling animations, mouse tracking). Don't allow it to process sensitive user data like passwords, payment info, or personal details.
- Restrict DOM access: Ensure the skill can only modify animation elements, not access or alter form fields, cookies, or authentication tokens.
- Disable external API calls: Verify the animation library cannot make requests to external servers or third-party services beyond your controlled domain.
Network isolation
- Load from trusted CDN only: If using a hosted version, verify it comes from your organization's content delivery network (CDN), not public untrusted sources.
- Block outbound connections: Configure your firewall/network to prevent the animation library from sending data to unknown external servers or logging services.
- Use content security headers: Implement web security headers (CSP - Content Security Policy) to restrict what scripts can execute and where they can communicate.
Monitoring
- Log all animation interactions: Track which pages use oil-motion and when it executes, to detect unusual or unauthorized deployments.
- Watch for performance anomalies: Monitor browser CPU and memory usage—unexpected spikes could indicate malicious code injection or data exfiltration attempts.
- Review dependency updates manually: Before updating the library, check the changelog and test updates in a staging environment first; don't auto-update.
Red flags to watch for
- Unexpected network traffic: Monitor if the library attempts to connect to unfamiliar domains or sends data packets outside your organization.
- Code changes without notification: If the library updates without your team's approval or the repository suddenly shows new contributors, pause use immediately.
- Performance degradation: Slowdowns, crashes, or unresponsive pages after deployment may signal injected malicious code—roll back and investigate.
Alternatives
- Framer Motion — mature, well-maintained React animation library with stronger community security review
- GSAP (GreenSock Animation Platform) — industry-standard animation engine with decades of production use
- Animate.css — lightweight CSS-based animations, lower code injection surface than JavaScript libraries
- Tailwind CSS with native animation utilities — minimal dependency surface, built into modern web stacks