lottie-animation-delivery
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns or suspicious behaviors were detected. The skill consists of best-practice documentation and references established industry standards from trusted organizations such as Airbnb, W3C, and Mozilla.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a vulnerability surface in Lottie JSON data, which can contain 'expressions' (embedded logic) that could be used for injection attacks or unauthorized execution.
- Ingestion points: Lottie JSON files and dotLottie archive packages described in SKILL.md.
- Boundary markers: The skill does not define specific input boundaries for the processed JSON files.
- Capability inventory: The skill identifies rendering and script execution capabilities within the
lottie-webplayer environment (SKILL.md). - Sanitization: The skill explicitly recommends disabling expressions via player settings and ensuring that archive paths do not escape their containers to maintain security and determinism (SKILL.md).
Audit Metadata