gsap
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The utility script
scripts/extract-audio-data.pyuses thesubprocess.runfunction to executeffmpegfor audio decoding. The implementation uses an argument list rather than a shell string, which is a standard security best practice to prevent command injection. - [EXTERNAL_DOWNLOADS]: The documentation includes instructions to load the GSAP animation library and the TextPlugin from the JSDelivr CDN (
cdn.jsdelivr.net), which is a well-known and trusted service for front-end development. - [DATA_EXFILTRATION]: The skill mentions the use of
XMLHttpRequestto fetch local data files. This is used for synchronous data loading required by the FrameVideo rendering engine and does not involve exfiltrating data to external servers.
Audit Metadata