The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions focus exclusively on animation logic and implementation details. There are no attempts to override agent behavior, bypass safety guardrails, or extract system prompts.
[DATA_EXFILTRATION]: No network operations (such as curl, fetch, or wget) or file system access to sensitive directories (~/.ssh, ~/.aws, .env) were detected. The skill only interacts with local DOM elements and pointer event data.
[OBFUSCATION]: All code and documentation are provided in clear, readable text. No Base64, hex encoding, zero-width characters, or homoglyph substitutions were found.
[REMOTE_CODE_EXECUTION]: The skill does not download or execute scripts from remote servers. References to 'greensock/gsap-skills' target a well-known and trusted vendor in the web animation ecosystem.
[DYNAMIC_EXECUTION]: The skill uses standard JavaScript functions and GSAP methods. No dangerous dynamic evaluation patterns, such as eval() or unsafe deserialization, are present.
[INDIRECT_PROMPT_INJECTION]: The skill contains a surface for processing external data through mouse and pointer events.
Ingestion points: Pointer event listeners in SKILL.md and references/cursor-patterns.md capture e.clientX, e.clientY, and e.target data.
Boundary markers: Not applicable, as the data is treated as numerical coordinates rather than natural language instructions.
Capability inventory: Capabilities are strictly limited to GSAP animations and DOM style updates. No file-writing, network communication, or shell command execution capabilities are present.
Sanitization: Event data is passed to interpolation utilities (gsap.utils.interpolate) and position tweens (gsap.quickTo), effectively treating the input as numerical values with no executable potential.

gsap-cursor