fx-typewriter-multi
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a presentation-layer animation effect designed for web and video surfaces. It operates entirely within the browser context using standard DOM APIs and CSS animations, with no access to sensitive system resources or external network services.- [INDIRECT_PROMPT_INJECTION]: An analysis of the data ingestion surface was performed to evaluate the risk of indirect prompt injection.
- Ingestion points:
typewriter-multi.jsreads text values fromdata-fx-line1,data-fx-line2, anddata-fx-line3attributes on the target DOM element. - Boundary markers: None are present in the attribute values.
- Capability inventory: The skill is restricted to DOM manipulation and local UI updates. It lacks the capability to write files, execute shell commands, or perform network requests.
- Sanitization: The implementation uses
textContentto append characters to the UI. This inherently prevents the execution of any embedded HTML or script content, ensuring that ingested data is treated strictly as plain text.
- Ingestion points:
Audit Metadata