gsap
Warn
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: MEDIUMOBFUSCATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded string assigned toencodedHtmlwhich represents the complete source code for a web animation demo. - [DYNAMIC_EXECUTION]: The script in
demo/index.htmldecodes theencodedHtmlstring and dynamically injects it into a sandboxed iframe via thesrcdocproperty at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill provides a demo reference intended to influence the agent's output quality, creating an ingestion surface for complex code instructions. 1. Ingestion points:
demo/index.html(reference content). 2. Boundary markers: None. 3. Capability inventory: File writing (HTML/JS generation). 4. Sanitization: None. - [EXTERNAL_DOWNLOADS]: The skill references several external resources from well-known and trusted providers for its demo environment. Fetches runtime dependencies from official CDNs including cdnjs.cloudflare.com and code.iconify.design. Loads fonts from Google Fonts and Fontshare.
Audit Metadata