true-focus
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes text content from HTML elements with the class
.tf. It ingests this data viatextContentand splits it into individual words. However, the capability set is restricted to visual DOM manipulation (toggling CSS classes), and it uses the safes.textContent = wmethod to create new elements, preventing Cross-Site Scripting (XSS). No downstream capabilities like network or file access are present. - [SAFE]: All files (SKILL.md, true-focus.js, true-focus.css) were reviewed for malicious patterns. The JavaScript uses standard browser APIs (
matchMedia,querySelectorAll,setInterval) to cycle classes for animation purposes. The author (nexu-io) and implementation align with the stated purpose of a UI animation utility.
Audit Metadata