gsap

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/extract-audio-data.py uses subprocess.run() to execute ffmpeg. This is used to decode audio/video files and extract raw samples for frequency analysis, which is the primary purpose of the utility.
  • [EXTERNAL_DOWNLOADS]: The documentation in references/effects.md includes HTML snippets that load the GSAP library and the TextPlugin from the JSDelivr CDN (cdn.jsdelivr.net), a well-known and trusted service for static assets.
  • [DATA_EXPOSURE]: The skill documents the use of XMLHttpRequest to synchronously load local audio-data.json files. This is described as a requirement for deterministic timeline construction in the HyperFrames environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where the agent processes external audio data.
  • Ingestion points: references/effects.md describes loading frequency data from audio-data.json via XMLHttpRequest.
  • Boundary markers: No specific delimiters are used for the JSON data, but the data format is strictly numeric (floats for RMS and frequency bands).
  • Capability inventory: The data is used to drive GSAP animation parameters (x, y, scale, opacity) and canvas drawing commands.
  • Sanitization: The Python script scripts/extract-audio-data.py enforces the numeric schema when generating the JSON, and the JS patterns use these values directly as animation offsets.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 04:09 PM
Security Audit — agent-trust-hub — gsap