frontend-atlas
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides installation commands for numerous popular and well-known front-end libraries and registries including GSAP, Motion, Three.js, and components from registries like Magic UI, Aceternity, and 21st.dev. It also references reputable documentation and inspiration sites. These are all standard resources in the web development ecosystem.
- [COMMAND_EXECUTION]: Includes several Node.js scripts for maintenance (
build-index.mjs,check-links.mjs) and auditing (motion-audit.mjs,contact-sheet.mjs). These tools are intended for use by developers to manage the skill's references or to audit their own project's performance locally. - [INDIRECT_PROMPT_INJECTION]: The
motion-audit.mjsscript accepts a user-supplied URL and instruments the resulting page using Playwright to collect performance metrics. While this involves processing external content, the risk is minimal as the script's operations are confined to performance instrumentation within a controlled browser environment for development purposes. No unsanitized data from the audited page is executed or interpreted as instructions. - [REMOTE_CODE_EXECUTION]: Mentions several scripts loaded via well-known CDNs (e.g., GSAP, scroll-timeline polyfill) within its recipes. These are established, reputable utilities commonly used in modern web development.
Audit Metadata