deconstruct
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious behavior detected. The skill provides a clear methodology for animation analysis and uses standard web technologies for its viewer tool.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests data from external web pages and source code to populate an animation timeline.
- Ingestion points: External data is written to
timeline.js(specifically thepreview.htmlandpreview.cssfields) by the agent. - Boundary markers: No explicit delimiters or warnings are used to sequester this external data within the generated file.
- Capability inventory: The skill includes a
viewer.htmltool that renders the extracted data. The agent is capable of writing the data file used by this viewer. - Sanitization: The
viewer.htmltool usesinnerHTMLto render the extracted properties without sanitization. However, this is consistent with the tool's purpose as a developer utility for local animation analysis.
Audit Metadata