web-animation-view-transitions

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill demonstrates secure coding practices by providing comprehensive feature detection guards for all API calls and strictly adhering to accessibility best practices, specifically regarding prefers-reduced-motion media queries.
  • [INDIRECT_PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection or cross-site scripting (XSS) within the modal implementation pattern in examples/shared-elements.md.
  • Ingestion points: The modalContent variable is passed into the openModalFromElement function.
  • Boundary markers: Delimiters are absent for the interpolated data.
  • Capability inventory: The skill is constrained to UI rendering and does not possess capabilities for command execution, network exfiltration, or sensitive file system access.
  • Sanitization: Sanitization is absent in Pattern 18 where data is directly injected into innerHTML, although the skill correctly uses textContent in other contexts like Pattern 3.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 12:10 PM