web-animation-view-transitions
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill demonstrates secure coding practices by providing comprehensive feature detection guards for all API calls and strictly adhering to accessibility best practices, specifically regarding prefers-reduced-motion media queries.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection or cross-site scripting (XSS) within the modal implementation pattern in
examples/shared-elements.md. - Ingestion points: The
modalContentvariable is passed into theopenModalFromElementfunction. - Boundary markers: Delimiters are absent for the interpolated data.
- Capability inventory: The skill is constrained to UI rendering and does not possess capabilities for command execution, network exfiltration, or sensitive file system access.
- Sanitization: Sanitization is absent in Pattern 18 where data is directly injected into
innerHTML, although the skill correctly usestextContentin other contexts like Pattern 3.
Audit Metadata