epic-design
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to include standard, well-known animation libraries (GSAP, ScrollTrigger, Lenis) via the jsDelivr CDN (cdn.jsdelivr.net). These are legitimate, widely-used resources in web development.
- [COMMAND_EXECUTION]: The skill includes two helper scripts: a Python script (scripts/inspect-assets.py) for analyzing image metadata and backgrounds, and a Node.js script (scripts/validate-layers.js) for auditing HTML structure and accessibility. Both scripts operate locally on the user's project files and do not perform network operations or privilege escalation.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data in the form of user-provided design briefs and image assets.
- Ingestion points: User-provided image files (processed by scripts/inspect-assets.py) and text-based project briefs.
- Boundary markers: None explicitly defined for binary image data; textual briefs are integrated into the agent's reasoning process.
- Capability inventory: The skill facilitates local file reading (via the provided scripts) and generation of HTML/CSS/JS code based on user input.
- Sanitization: The Python script analyzes pixel data and metadata without executing embedded content; the Node.js script uses regular expressions for static analysis of HTML files.
- [DYNAMIC_EXECUTION]: The agent generates executable web code (JavaScript) based on the provided templates and user requirements. This is the primary intended function of the skill and follows established web development patterns.
Audit Metadata