gsap-scrolltrigger
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and downloads official GSAP, ScrollTrigger, and ScrollToPlugin libraries from the well-known and trusted
cdn.jsdelivr.netcontent delivery network. - [COMMAND_EXECUTION]: The skill includes standalone Python scripts (
scripts/generate_animation.pyandscripts/timeline_builder.py) intended to be executed by developers to automate the creation of animation boilerplate and interactive timeline sequences. - [INDIRECT_PROMPT_INJECTION]: As a code generation utility, the skill presents an attack surface where untrusted user input could be interpolated into generated files. 1. Ingestion points: CLI arguments and interactive inputs in the included Python scripts. 2. Boundary markers: None present in the generation templates. 3. Capability inventory: Scripts utilize
pathlib.Path.write_textto perform local file-write operations. 4. Sanitization: Minimal; the scripts use standard string interpolation without explicit validation of input content. - [DYNAMIC_EXECUTION]: The skill involves dynamic generation of JavaScript code at runtime based on user-supplied parameters, although the skill itself does not facilitate the execution of this code within the agent's restricted environment.
Audit Metadata