p5js
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the p5.js core library and several community addons (p5.sound, p5.brush, p5.grain, CCapture.js) which are sourced from established CDNs including Cloudflare (cdnjs), unpkg, and jsDelivr.
- [COMMAND_EXECUTION]: Local shell and Node.js scripts are provided to verify system dependencies, launch a local asset server using Python or Node.js, and manage a frame-capture pipeline involving Puppeteer and ffmpeg.
- [INDIRECT_PROMPT_INJECTION]: The skill uses user text prompts as ingestion points for creative content (SKILL.md). While the agent acts as a boundary, there are no explicit sanitization procedures or boundary markers for user-supplied data which is then used to generate JavaScript code executed via the local rendering pipeline (render.sh, export-frames.js).
- [DYNAMIC_EXECUTION]: The headless capture script utilizes Puppeteer's evaluation capabilities to programmatically advance the p5.js draw loop for deterministic high-resolution rendering.
- [SAFE]: The Puppeteer configuration for headless export includes flags to disable web security and allow local file access. These settings are a standard requirement for rendering local HTML files that need to load assets like fonts or images without encountering CORS restrictions in a non-web environment.
Audit Metadata