pretext
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes well-known CDNs such as esm.sh and jsdelivr to load dependencies like GSAP, lil-gui, and the pretext library. All external scripts are imported using standard ESM syntax.
- [SAFE]: All external URLs and GitHub repositories refer to legitimate development tools, library authors, or community showcases, with no evidence of typosquatting or homoglyph attacks.
- [SAFE]: The code snippets included in the templates, such as the Rust-like source code in
donut-orbit.html, are static strings used for visual demonstration (typing animation) and contain no executable shell commands or hardcoded credentials. - [SAFE]: The skill does not attempt to access sensitive file paths, environment variables, or perform unauthorized network operations.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text for rendering on an HTML5 Canvas. While this text is not sanitized, the rendering process is isolated and the skill lacks capabilities (such as command execution or file writes) that would allow the rendered text to act as malicious instructions.
Audit Metadata