optimize-web-animations
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various shell commands to manage the development workflow, including
git status,git diff, andgit commit. It also utilizesnpm run lintandnpm run buildfor local code verification. These commands are typical for an agent tasked with code optimization. - [DYNAMIC_EXECUTION]: The skill uses
playwright.evaluateto run JavaScript code within a browser tab. These scripts perform performance profiling by iterating through DOM elements and measuring CSS animation properties. This dynamic execution is essential for the skill's stated purpose of performance auditing. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from web pages by extracting text and class names from the DOM via the profiling scripts.
- Ingestion points:
references/browser-profiling.mdcontains scripts that readelement.textContentandelement.classNamefrom the active browser tab. - Boundary markers: No explicit boundary markers or 'ignore' instructions are used when passing this data to the agent.
- Capability inventory: The skill has the ability to commit code changes via
gitand run arbitrary shell commands defined inpackage.json(e.g.,npm run build). - Sanitization: The scripts apply basic sanitization by truncating extracted strings using
.slice(0, 80)or.slice(0, 180), which limits the payload size for any potential injection.
Audit Metadata