auto-animate
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a configuration script
scripts/init-auto-animate.shthat detects the project environment and executes package managers (npm, pnpm, or yarn) to install the necessary library. - [EXTERNAL_DOWNLOADS]: The initialization script downloads the
@formkit/auto-animatepackage from the official npm registry, which is a well-known and trusted service. - [DYNAMIC_EXECUTION]: The initialization script dynamically generates local files, such as
useAutoAnimateSafe.tsandAnimatedListExample.tsx, by writing static boilerplate code into the project's source directory. - [INDIRECT_PROMPT_INJECTION]: The provided React templates in the
templates/directory (e.g.,filter-sort-list.tsx,form-validation.tsx) handle user-provided data for rendering. While this creates a potential surface for indirect prompt injection if untrusted data is displayed, the skill itself contains no malicious instructions and follows standard UI development patterns. Mandatory Evidence Chain: (1) Ingestion points: Product lists, task titles, and form data in templates; (2) Boundary markers: Absent; (3) Capability inventory: File writing and dependency installation via setup scripts; (4) Sanitization: Absent in the UI templates. - [METADATA_POISONING]: A discrepancy exists between the author name in the plugin metadata (Jeremy Dawes) and the provided author context (ma1orek). This is documented as a minor metadata inconsistency that does not affect the skill's security profile.
Audit Metadata