gsap
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/extract-audio-data.pyusessubprocess.run()to executeffmpeg. This is used to decode audio/video files and extract raw samples for frequency analysis, which is the primary purpose of the utility. - [EXTERNAL_DOWNLOADS]: The documentation in
references/effects.mdincludes HTML snippets that load the GSAP library and the TextPlugin from the JSDelivr CDN (cdn.jsdelivr.net), a well-known and trusted service for static assets. - [DATA_EXPOSURE]: The skill documents the use of
XMLHttpRequestto synchronously load localaudio-data.jsonfiles. This is described as a requirement for deterministic timeline construction in the HyperFrames environment. - [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where the agent processes external audio data.
- Ingestion points:
references/effects.mddescribes loading frequency data fromaudio-data.jsonviaXMLHttpRequest. - Boundary markers: No specific delimiters are used for the JSON data, but the data format is strictly numeric (floats for RMS and frequency bands).
- Capability inventory: The data is used to drive GSAP animation parameters (
x,y,scale,opacity) and canvas drawing commands. - Sanitization: The Python script
scripts/extract-audio-data.pyenforces the numeric schema when generating the JSON, and the JS patterns use these values directly as animation offsets.
Audit Metadata