gsap-web
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the GSAP core library and plugins from the well-known and trusted Cloudflare CDN (cdnjs.cloudflare.com).
- [EXTERNAL_DOWNLOADS]: Contains links to the vendor's official domain (
iart.ai) for documentation and attribution, which are considered safe vendor resources. - [PROMPT_INJECTION]: The skill facilitates the generation of JavaScript code based on untrusted user animation requirements, creating a surface for indirect prompt injection.
- Ingestion points: User descriptions of animation goals (e.g., "build a scroll animation", "create a hero timeline").
- Boundary markers: The instructions lack specific delimiters or instructions to ignore embedded commands within user requirements.
- Capability inventory: The skill generates complex JavaScript logic for browser-based animations using GSAP and its plugins, as detailed in
SKILL.mdandexamples/hero-timeline.js. - Sanitization: There is no evidence of validation or sanitization of the user-provided strings before they influence code generation.
Audit Metadata