orbit-card
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a visual animation component using established web technologies and libraries (Three.js, GSAP).
- [REMOTE_CODE_EXECUTION]: The installation and rendering instructions utilize
npxto fetch and run thehyperframespackage from the public npm registry. This represents a standard workflow for this toolset and originates from the vendor's own package ecosystem. - [INDIRECT_PROMPT_INJECTION]: The component ingests untrusted text data that is rendered onto a 3D canvas. * Ingestion points:
V.feature1Title,V.feature1Descinassets/orbit-scene.js. * Boundary markers: Absent. * Capability inventory: Three.js 3D rendering and GSAP animation logic inassets/orbit-scene.jsandorbit-card.html. * Sanitization: Card accent color is validated via regex; title and description strings are not sanitized but are only used for canvas text rendering.
Audit Metadata