serega-gentle
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references an external URL (https://pixelpoint.io/skills/animate-text/) in references/effect.json as the source for the animation recipe. This is an informational reference and does not involve runtime code execution or untrusted downloads.
- [INDIRECT_PROMPT_INJECTION]: The skill processes arbitrary text input for animation, creating a potential surface for indirect prompt injection.
- Ingestion points: Text is ingested from element.textContent or provided via the phrases option in assets/waapi/serega-gentle.js.
- Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are used during text processing.
- Capability inventory: The skill is limited to DOM manipulation (replaceChildren, createElement) and Web Animations API calls (element.animate). No high-risk capabilities like network access or file writes are exposed to the processed data.
- Sanitization: Uses textContent for individual character units, preventing direct HTML injection.
Audit Metadata