gsap
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes HTML templates that fetch the GSAP and TextPlugin libraries from the jsDelivr CDN, which is a well-known and widely used service for hosting front-end assets.
- [COMMAND_EXECUTION]: The
extract-audio-data.pyscript executes theffmpegcommand-line utility viasubprocess.runto decode audio and video files. This is a functional requirement for generating the visualization data used by the animation effects. - [INDIRECT_PROMPT_INJECTION]: The skill's architecture for audio visualization involves an ingestion surface for untrusted external media files.
- Ingestion points: The
extract-audio-data.pyscript processes file paths provided via command-line arguments, and the JavaScript examples ineffects.mdload extracted JSON data. - Boundary markers: The skill uses structured JSON for data exchange and defined timeline registration patterns (
window.__timelines) to separate logic from data. - Capability inventory: The skill is capable of executing subprocesses (ffmpeg) and performing synchronous network requests (XMLHttpRequest) for data loading.
- Sanitization: The Python utility script follows the security best practice of passing arguments as a list to
subprocess.run, which prevents shell command injection.
Audit Metadata