optimize-web-animations

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes various shell commands to manage the development workflow, including git status, git diff, and git commit. It also utilizes npm run lint and npm run build for local code verification. These commands are typical for an agent tasked with code optimization.
  • [DYNAMIC_EXECUTION]: The skill uses playwright.evaluate to run JavaScript code within a browser tab. These scripts perform performance profiling by iterating through DOM elements and measuring CSS animation properties. This dynamic execution is essential for the skill's stated purpose of performance auditing.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from web pages by extracting text and class names from the DOM via the profiling scripts.
  • Ingestion points: references/browser-profiling.md contains scripts that read element.textContent and element.className from the active browser tab.
  • Boundary markers: No explicit boundary markers or 'ignore' instructions are used when passing this data to the agent.
  • Capability inventory: The skill has the ability to commit code changes via git and run arbitrary shell commands defined in package.json (e.g., npm run build).
  • Sanitization: The scripts apply basic sanitization by truncating extracted strings using .slice(0, 80) or .slice(0, 180), which limits the payload size for any potential injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 04:39 PM