The Agent Skills Directory

[SAFE]: The skill instructions and code recipes do not contain any malicious patterns. All identified external resources and behaviors are consistent with the primary purpose of UI animation.
[EXTERNAL_DOWNLOADS]: The skill references font assets from Google Fonts (fonts.googleapis.com), which is a well-known and trusted service for web typography.
[INDIRECT_PROMPT_INJECTION]: The skill includes JavaScript recipes that ingest text content from the DOM (textContent or dataset.text) to apply per-character animations. While this constitutes an ingestion surface for potentially untrusted data, the capabilities are restricted to visual DOM manipulation, and the code uses safe APIs like textContent and appendChild that prevent script execution.
Ingestion points: Text content is read in SKILL.md (weightWave and cursorWeight functions) and reference.md (gsapWeightStagger function).
Boundary markers: Absent; the text is processed as raw character data for visual splitting.
Capability inventory: DOM manipulation (createElement, appendChild), event listeners (mousemove, hover), and animation loops (requestAnimationFrame). No network, shell, or file access capabilities are present.
Sanitization: Not explicitly performed, but the use of textContent when creating new elements effectively sanitizes the input by treating it as literal text.

variable-font-animation