gsap

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes HTML templates that fetch the GSAP and TextPlugin libraries from the jsDelivr CDN, which is a well-known and widely used service for hosting front-end assets.
  • [COMMAND_EXECUTION]: The extract-audio-data.py script executes the ffmpeg command-line utility via subprocess.run to decode audio and video files. This is a functional requirement for generating the visualization data used by the animation effects.
  • [INDIRECT_PROMPT_INJECTION]: The skill's architecture for audio visualization involves an ingestion surface for untrusted external media files.
  • Ingestion points: The extract-audio-data.py script processes file paths provided via command-line arguments, and the JavaScript examples in effects.md load extracted JSON data.
  • Boundary markers: The skill uses structured JSON for data exchange and defined timeline registration patterns (window.__timelines) to separate logic from data.
  • Capability inventory: The skill is capable of executing subprocesses (ffmpeg) and performing synchronous network requests (XMLHttpRequest) for data loading.
  • Sanitization: The Python utility script follows the security best practice of passing arguments as a list to subprocess.run, which prevents shell command injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 04:33 PM