glass-shard-title
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The build script
build-bundle.mjsusesexecFileSyncto runnpx esbuild. This is a standard developer workflow for bundling and minifying JavaScript assets for the animation and is not considered malicious. - [EXTERNAL_DOWNLOADS]: The skill fetches JavaScript dependencies (GSAP and D3-Delaunay) from the well-known
cdn.jsdelivr.netservice. It also downloads an environment asset from the vendor's official domain (static.heygen.ai). - [INDIRECT_PROMPT_INJECTION]: The skill accepts a
headlinestring via user-controlled variables. This data is ingested and rendered as a 3D texture within a Three.js environment. The skill utilizes a structured schema inglass-shard-title.htmlto define boundaries for these inputs.
Audit Metadata